CVE-2026-26017: CoreDNS ACL Bypass
A logical vulnerability in CoreDNS allows DNS access controls to be bypassed due to the default execution order of plugins. Security plugins such as acl are evaluated before the rewrite plugin, resulting in a Time-of-Check Time-of-Use (TOCTOU) flaw.
Impact
In multi-tenant Kubernetes clusters, this flaw undermines DNS-based segmentation strategies.
Example scenario: 1. ACL blocks access to .admin.svc.cluster.local 2. A rewrite rule maps public-name → admin.svc.cluster.local 3. An unprivileged pod queries public-name 4. ACL allows the request 5. Rewrite exposes the internal admin service IP
This allows unauthorized service discovery and reconnaissance of restricted internal infrastructure.
Patches Has the problem been patched? What versions should users upgrade to?
Workarounds
- Reorder the default plugin.cfg so that: - rewrite and other normalization plugins run before acl, opa, and firewall - Ensure all access control checks are applied after name normalization.
Other sources
CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a logical vulnerability in CoreDNS allows DNS access controls to be bypassed due to the default execution order of plugins. Security plugins such as acl are evaluated before the rewrite plugin, resulting in a Time-of-Check Time-of-Use (TOCTOU) flaw. This issue has been patched in version 1.14.2.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/coredns/corednsto a version that resolves this vulnerability.Fixed in 1.14.2 - Upgrade
Upgrade
CoreDNSto a version that resolves this vulnerability.Fixed in 1.14.2 - Configuration
Reorder plugin.cfg so that rewrite and other normalization plugins run before acl, opa, and firewall (so name normalization occurs before access-control checks).
CoreDNS plugin chain (plugin.cfg) plugin execution order = Ensure rewrite and other normalization plugins run before acl, opa, and firewall
Event History
Frequently Asked Questions
What is the severity of CVE-2026-26017?
CVE-2026-26017 is considered a high-severity vulnerability due to its potential for unauthorized access control bypass.
How do I fix CVE-2026-26017?
You can fix CVE-2026-26017 by upgrading CoreDNS to version 1.14.2 or later.
Which versions of CoreDNS are affected by CVE-2026-26017?
CVE-2026-26017 affects CoreDNS versions prior to 1.14.2.
What is the nature of the vulnerability described in CVE-2026-26017?
CVE-2026-26017 is a logical vulnerability that allows the bypass of DNS access controls due to the default execution order of plugins.
What components of CoreDNS are involved in CVE-2026-26017?
The vulnerability involves the acl security plugin and the rewrite plugin, which are evaluated in a manner that leads to access control issues.