What is the CVSS score of CVE-2026-26017?

CVE-2026-26017 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Coredns are affected by CVE-2026-26017?

CoreDNS versions prior to 1.14.2 contain a logical vulnerability that allows attackers to bypass DNS access controls through plugin execution order manipulation.. A patch is available.

Is there a public PoC exploit available for CVE-2026-26017?

Yes, a public proof-of-concept exploit is available for CVE-2026-26017. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-26017?

Within 24 hours: Identify all CoreDNS instances in production and staging environments and document their current versions. Within 7 days: Implement network segmentation to restrict CoreDNS query sources and monitor DNS traffic for anomalous access patterns. Within 30 days: Evaluate upgrade path to CoreDNS 1.14.2 or later, coordinate with development teams on testing timelines, and execute patching on a defined schedule prioritizing production systems.

Coredns CVE-2026-26017

MEDIUM

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-03-06 security-advisories@github.com

GHSA-c9v3-4pv7-87pr

Coredns Authentication Bypass

6.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

SUSE

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Red Hat

7.7 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Jun 30, 2026 - 03:24 NVD

HIGH MEDIUM

CVSS changed

Jun 30, 2026 - 03:24 NVD

7.7 (HIGH) 6.3 (MEDIUM)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 06, 2026 - 16:16 nvd

HIGH 7.7

DescriptionNVD

CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a logical vulnerability in CoreDNS allows DNS access controls to be bypassed due to the default execution order of plugins. Security plugins such as acl are evaluated before the rewrite plugin, resulting in a Time-of-Check Time-of-Use (TOCTOU) flaw. This issue has been patched in version 1.14.2.

AnalysisAI

CoreDNS versions prior to 1.14.2 allow authenticated attackers to bypass DNS access controls through a Time-of-Check Time-of-Use race condition in the plugin execution chain, where the rewrite plugin processes requests after security plugins like ACL have already validated them. An attacker with network access can exploit this logical flaw to access DNS records that should be restricted by configured access control policies. No patch is currently available for affected deployments.

Technical ContextAI

Affects Coredns. CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a logical vulnerability in CoreDNS allows DNS access controls to be bypassed due to the default execution order of plugins. Security plugins such as acl are evaluated before the rewrite plugin, resulting in a Time-of-Check Time-of-Use (TOCTOU) flaw. This issue has been patched in version 1.14.2.

RemediationAI

Fixed in version 1.14.2.. Restrict network access to the affected service where possible.

More in Coredns

View all

CVE-2026-26018 HIGH This Week POC

7.5 Mar 06

Coredns versions up to 1.14.2 contains a vulnerability that allows attackers to crash the DNS server by sending speciall

CVE-2025-68151 HIGH This Week

7.5 Jan 08

CoreDNS is a DNS server that chains plugins. Prior to version 1.14.0, multiple CoreDNS server implementations (gRPC, HTT

CVE-2025-47950 HIGH This Week

7.5 Jun 06

A denial of service vulnerability in versions (CVSS 7.5). High severity vulnerability requiring prompt remediation. Vend

Same weakness CWE-367 – Time-of-check Time-of-use (TOCTOU) Race Condition

View all

CVE-2024-30088 HIGH POC

7.0

CVE-2025-22224 CRITICAL

9.3

CVE-2022-48618 HIGH

7.0

CVE-2023-38146 HIGH POC

8.8

CVE-2025-34027 CRITICAL POC

10.0

CVE-2020-1337 HIGH POC

7.8

CVE-2026-25641 CRITICAL POC

10.0

CVE-2024-28718 CRITICAL POC

9.8

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2012-1723 CRITICAL POC

9.8

CVE-2017-10271 HIGH POC

7.5

CVE-2015-1427 CRITICAL POC

9.8

CVE-2025-3248 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: High

Product	Status
SUSE Package Hub 15 SP6	Fixed
openSUSE Leap 15.6	Fixed
openSUSE Tumbleweed	Fixed
openSUSE Leap 15.6	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP5	Fixed

CVE-2026-26017 vulnerability details – vuln.today

Back

Coredns CVE-2026-26017

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

More in Coredns

Same weakness CWE-367 – Time-of-check Time-of-use (TOCTOU) Race Condition

Same technique Authentication Bypass

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code