CVE-2026-33190: CoreDNS TSIG Auth Bypass Vulnerability

CVE-2026-33190 Overview

CoreDNS is a DNS server that chains plugins for extensible name resolution. CVE-2026-33190 is a TSIG authentication bypass affecting CoreDNS versions prior to 1.14.3. The tsig plugin trusts the transport writer's TsigStatus() method instead of independently verifying TSIG signatures. On DNS over TLS (DoT), DNS over HTTPS (DoH), DoH3, DNS over QUIC (DoQ), and gRPC transports, this status is unconditionally nil, which causes the plugin to treat unsigned requests as authenticated. Plain DNS over TCP and UDP transports remain unaffected. The flaw is tracked under [CWE-303] (Incorrect Implementation of Authentication Algorithm).

Critical Impact
Unauthenticated remote attackers can bypass tsig require all policies and access DNS resources intended to be restricted to TSIG-authenticated clients.

Affected Products

CoreDNS versions prior to 1.14.3
Deployments exposing the tsig plugin over DoT, DoH, or DoH3
Deployments exposing the tsig plugin over DoQ or gRPC transports

Discovery Timeline

2026-05-05 - CVE-2026-33190 published to NVD
2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-33190

Vulnerability Analysis

The CoreDNS tsig plugin enforces Transaction Signature (TSIG) authentication on incoming DNS queries. Instead of verifying the TSIG record itself, the plugin delegates trust to the response writer's TsigStatus() method. Each transport implements this method differently, and the encrypted transports do not perform TSIG verification before returning a status.

The DoH and DoH3 writers always return nil from TsigStatus(). The DoT server fails to set TsigSecret on the underlying dns.Server, leaving verification disabled. The DoQ and gRPC writers also unconditionally return nil. The plugin interprets a nil status as a valid signature, allowing requests with no TSIG record or invalid signatures to satisfy a tsig require all policy.

Root Cause

The root cause is misplaced trust in transport-layer signature status reporting. TSIG verification should occur in the plugin against the request's TSIG resource record using the configured shared secret. Instead, the implementation defers to writer methods that never perform the cryptographic check on encrypted transports.

Attack Vector

An unauthenticated remote attacker sends a DNS query over DoT, DoH, DoH3, DoQ, or gRPC to a CoreDNS instance configured with the tsig plugin. The query may omit the TSIG record entirely or include an invalid one. The transport writer returns TsigStatus() == nil, the plugin accepts the request, and the attacker receives responses or executes operations gated by the TSIG policy. Plain DNS over TCP and UDP correctly invoke the underlying miekg/dns library verification and are not exploitable.

Refer to the GitHub Security Advisory GHSA-qhmp-q7xh-99rh for the upstream technical description.

Detection Methods for CVE-2026-33190

Indicators of Compromise

DNS queries arriving over DoT, DoH, DoH3, DoQ, or gRPC without a TSIG record but receiving successful responses from a CoreDNS server configured with tsig require all.
Successful zone transfers (AXFR/IXFR) or dynamic updates from source IPs that have no provisioned shared key.
CoreDNS access logs showing authenticated-context responses from clients lacking corresponding TSIG key configuration.

Detection Strategies

Inventory CoreDNS instances and identify which expose the tsig plugin combined with DoT, DoH, DoH3, DoQ, or gRPC server blocks in Corefile.
Replay test requests without TSIG records against non-production endpoints and confirm whether the server rejects them; vulnerable versions will respond.
Compare the running CoreDNS binary version against 1.14.3 using coredns -version across the fleet.

Monitoring Recommendations

Forward CoreDNS query logs and connection metadata to a centralized analytics platform for correlation against expected TSIG client populations.
Alert on any AXFR, IXFR, or UPDATE message received over an encrypted transport from a source not present in the TSIG key allowlist.
Track anomalies in query volume on DoT, DoH, DoH3, DoQ, and gRPC listeners that correspond to zones protected by tsig require all.

How to Mitigate CVE-2026-33190

Immediate Actions Required

Upgrade CoreDNS to version 1.14.3 or later on all instances that expose encrypted DNS transports.
Audit Corefile configurations for the tsig plugin paired with tls, https, quic, or grpc server blocks and prioritize those for patching.
Rotate any TSIG shared secrets that may have been exposed to unauthorized clients during the vulnerable window.

Patch Information

The issue is fixed in CoreDNS v1.14.3. The patched release performs TSIG verification within the plugin against the request's signature using the configured secrets, rather than relying on the transport writer's TsigStatus().

Workarounds

Restrict CoreDNS to plain DNS over TCP and UDP until the upgrade can be deployed, since these transports are not affected.
Place a network access control layer (firewall, mTLS-terminating proxy) in front of DoT, DoH, DoH3, DoQ, and gRPC listeners to limit reach to known TSIG clients.
Disable the tsig plugin on encrypted transport server blocks if TSIG enforcement is not strictly required.

bash

# Verify the running CoreDNS version
coredns -version

# Example: pin the patched image in Kubernetes
kubectl set image deployment/coredns -n kube-system \
  coredns=coredns/coredns:1.14.3