DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-86003: CVE-2026-86003: Unintended Proxying of DNS UPDATE Requests via Alternative Transports in CoreDNS

#security #cve #cybersecurity

CVE-2026-86003: Unintended Proxying of DNS UPDATE Requests via Alternative Transports in CoreDNS

Vulnerability ID: CVE-2026-86003
CVSS Score: 7.5
Published: 2026-09-17

A protocol-level validation bypass in CoreDNS versions prior to 1.14.7 allows unauthenticated remote attackers to proxy unauthorized DNS UPDATE messages (Opcode 5) using modern alternative transport layers such as DoH, DoH3, DoQ, and gRPC. If upstream authoritative servers trust the CoreDNS server's source IP and do not enforce TSIG authentication, attackers can inject, alter, or delete DNS zone records, leading to potential zone takeover or traffic redirection.

TL;DR

CoreDNS alternative transports failed to enforce default message acceptance policies on DNS headers, allowing remote attackers to send unauthorized DNS UPDATE queries that are forwarded to trusting upstream resolvers.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-441
  • Attack Vector: Network (AV:N)
  • CVSS Score: 7.5 (High)
  • Exploit Status: poc
  • KEV Status: Not Listed
  • Impact: High Integrity Impact (Zone manipulation)

Affected Systems

  • CoreDNS

Mitigation Strategies

  • Upgrade CoreDNS to version 1.14.7 or later.
  • Disable alternative transports (DoH, DoQ, gRPC) if not strictly required.
  • Enforce Transaction Signatures (TSIG) on upstream authoritative name servers to prevent unauthenticated updates.

Remediation Steps:

  1. Audit current CoreDNS deployment versions using 'coredns -version' or checking Kubernetes container images.
  2. Apply the v1.14.7 update package or patch the container image in the deployment configuration.
  3. Verify the Corefile configuration to identify and temporarily comment out alternative listeners (like 'doh', 'grpc') if upgrading cannot be done immediately.
  4. Update upstream DNS servers (such as BIND, Windows DNS) to mandate cryptographic TSIG keys for all Dynamic Updates instead of relying solely on IP allowlists.

References

Read the full report for CVE-2026-86003 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)