Vulnerability details
CVE-2026-26017
Red Hat Connectivity Link 1coredns coredns
CoreDNS ACL Bypass
CVSS 3.1
7.7High
Official description
CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a logical vulnerability in CoreDNS allows DNS access controls to be bypassed due to the default execution order of plugins. Security plugins such as acl are evaluated before the rewrite plugin, resulting in a Time-of-Check Time-of-Use (TOCTOU) flaw. This issue has been patched in version 1.14.2.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.7High | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N |
| 7.7High | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Red Hat | Red Hat Connectivity Link 1 | All | CVEProject cvelistV5 (CNA) |
| coredns | coredns | < 1.14.2 | CVEProject cvelistV5 (CNA) |
References and advisories
8- https://github.com/coredns/coredns/security/advisories/GHSA-c9v3-4pv7-87pr x_refsource_CONFIRM
- https://github.com/coredns/coredns/releases/tag/v1.14.2 x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2026-26017 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2445244 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26017.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:36873 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:25127 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8151 vendor-advisoryx_refsource_REDHAT
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-03-06
- Last updated
- 2026-07-15
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.42%
Probability of exploitation in 30 days
36.6%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-367Time-of-check Time-of-use (TOCTOU) Race Condition