Vulnerabilities ›

CVE-2026-33190

High ⚡ Exploit Available

CWE-303 — Weakness Type

                    Published: May 5, 2026                      ·  Modified: May 12, 2026                      ·  Source: NVD                

CVSS v3

7.5

🔗 NVD Official

📄 Description (English)

CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the tsig plugin can be bypassed on non-plain-DNS transports (DoT, DoH, DoH3, DoQ, and gRPC) because it trusts the transport writer's TsigStatus() instead of performing verification itself. The DoH and DoH3 writer's TsigStatus() always returns nil, the DoT server does not set TsigSecret on the dns.Server, and the DoQ and gRPC writers also unconditionally return nil. This allows an unauthenticated remote client to bypass TSIG-based authentication and access resources intended to be restricted behind a tsig require all policy. Plain DNS over TCP and UDP are not affected. This issue has been fixed in version 1.14.3.

🤖 AI Executive Summary

CoreDNS versions prior to 1.14.3 contain a critical authentication bypass vulnerability in the TSIG plugin affecting encrypted DNS transports (DoT, DoH, DoH3, DoQ, gRPC). Attackers can bypass TSIG authentication to access restricted DNS resources without valid credentials. This vulnerability is particularly severe for organizations relying on TSIG for DNS security in modern encrypted DNS implementations.

📄 Description (Arabic)

🤖 AI Intelligence Analysis Analyzed: May 9, 2026 14:28

🇸🇦 Saudi Arabia Impact Assessment

This vulnerability poses significant risk to Saudi critical infrastructure sectors: (1) ARAMCO and energy sector DNS infrastructure managing SCADA/ICS communications; (2) SAMA banking sector DNS systems handling financial transaction routing; (3) Government agencies (NCA, NCSC) using CoreDNS for secure DNS services; (4) STC and telecom providers operating DNS infrastructure; (5) Healthcare sector DNS systems managing patient data routing. The bypass of TSIG authentication enables unauthorized DNS poisoning, data exfiltration, and lateral movement within restricted networks.

🏢 Affected Saudi Sectors

Energy (ARAMCO, oil & gas infrastructure) Banking (SAMA regulated institutions) Government (NCA, NCSC, federal agencies) Telecommunications (STC, Mobily, Zain) Healthcare (Ministry of Health, hospitals) Critical Infrastructure (SCADA/ICS systems)

🎯 MITRE ATT&CK Techniques

T1040 - Traffic Redirection T1557 - Man-in-the-Middle T1557.002 - ARP Spoofing T1190 - Exploit Public-Facing Application T1021 - Remote Services T1071.004 - Application Layer Protocol (DNS)

⚖️ Saudi Risk Score (AI)

8.2

/ 10.0

🔧 Remediation Steps (English)

IMMEDIATE ACTIONS:

1. Identify all CoreDNS instances in your infrastructure and determine their versions

2. Audit TSIG policies to identify which resources are protected by TSIG authentication

3. Implement network segmentation to restrict DNS query sources to trusted networks only

4. Enable DNS query logging and monitoring for anomalous patterns



PATCHING:

1. Upgrade CoreDNS to version 1.14.3 or later immediately

2. Test patches in non-production environments before deployment

3. Coordinate upgrades with dependent services (Kubernetes clusters, service meshes)



COMPENSATING CONTROLS (if immediate patching not possible):

1. Disable encrypted DNS transports (DoT, DoH, DoH3, DoQ, gRPC) and use only plain DNS with TSIG over TCP/UDP

2. Implement firewall rules to restrict DNS queries to authorized IP ranges

3. Deploy DNS query inspection at network perimeter

4. Use VPN/mTLS for all DNS communications



DETECTION:

1. Monitor for TSIG authentication failures in CoreDNS logs

2. Alert on DNS queries from unexpected sources to TSIG-protected zones

3. Implement IDS signatures for TSIG bypass attempts

4. Track DNS response patterns for unauthorized zone transfers

🔧 خطوات المعالجة (العربية)

الإجراءات الفورية:

1. حدد جميع مثيلات CoreDNS في البنية التحتية الخاصة بك وحدد إصداراتها

2. قم بمراجعة سياسات TSIG لتحديد الموارد المحمية بمصادقة TSIG

3. تطبيق تقسيم الشبكة لتقييد مصادر استعلامات DNS إلى الشبكات الموثوقة فقط

4. تفعيل تسجيل استعلامات DNS والمراقبة للأنماط الشاذة

التصحيح:

1. قم بترقية CoreDNS إلى الإصدار 1.14.3 أو أحدث على الفور

2. اختبر التصحيحات في بيئات غير الإنتاج قبل النشر

3. نسق الترقيات مع الخدمات التابعة (مجموعات Kubernetes وشبكات الخدمات)

الضوابط البديلة (إذا لم يكن التصحيح الفوري ممكناً):

1. عطل نقل DNS المشفرة (DoT و DoH و DoH3 و DoQ و gRPC) واستخدم DNS عادي فقط مع TSIG عبر TCP/UDP

2. تطبيق قواعد جدار الحماية لتقييد استعلامات DNS على نطاقات IP المصرح بها

3. نشر فحص استعلامات DNS على محيط الشبكة

4. استخدم VPN/mTLS لجميع اتصالات DNS

الكشف:

1. راقب فشل مصادقة TSIG في سجلات CoreDNS

2. تنبيه على استعلامات DNS من مصادر غير متوقعة إلى مناطق محمية بـ TSIG

3. تطبيق توقيعات IDS لمحاولات تجاوز TSIG

4. تتبع أنماط استجابة DNS للتحويلات المنطقية غير المصرح بها

📋 Regulatory Compliance Mapping

🟢 NCA ECC 2024

ECC 2024 A.8.2.1 - User access management and authentication ECC 2024 A.8.2.3 - Management of privileged access rights ECC 2024 A.13.1.1 - Network security perimeter ECC 2024 A.13.1.3 - Segregation of networks

🔵 SAMA CSF

SAMA CSF ID.BE-1 - Governance and risk management SAMA CSF PR.AC-1 - Access control policy and processes SAMA CSF PR.AC-3 - Access enforcement SAMA CSF DE.CM-1 - Detection processes and tools

🟡 ISO 27001:2022

ISO 27001:2022 A.5.15 - Access control ISO 27001:2022 A.8.2 - User access management ISO 27001:2022 A.8.3 - User responsibilities ISO 27001:2022 A.13.1 - Network security

🟣 PCI DSS v4.0.1

PCI DSS 2.1 - Default security parameters PCI DSS 6.2 - Security patches and updates PCI DSS 8.1 - User identification and authentication

🔗 References & Sources 3

🔗

https://github.com/coredns/coredns/releases/tag/v1.14.3

security-advisories@github.com

Release Notes

🔗

https://github.com/coredns/coredns/security/advisories/GHSA-qhmp-q7xh-99rh

security-advisories@github.com

Exploit Vendor Advisory

🔗

https://github.com/coredns/coredns/security/advisories/GHSA-qhmp-q7xh-99rh

134c704f-9b21-4f2e-91b3-4a467353bcc0

Exploit Vendor Advisory

📦 Affected Products / CPE 1 entries

coredns.io:coredns

📊 CVSS Score

7.5

/ 10.0 — High

📊 CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack VectorN — None / Network

Attack ComplexityL — Low / Local

Privileges RequiredN — None / Network

User InteractionN — None / Network

ScopeU — Unchanged

ConfidentialityH — High

IntegrityN — None / Network

AvailabilityN — None / Network

📋 Quick Facts

Severity High

CVSS Score7.5

CWECWE-303

EPSS0.05%

Exploit ✓ Yes

Patch ✗ No

Published 2026-05-05

Source Feed nvd

🇸🇦 Saudi Risk Score

8.2

/ 10.0 — Saudi Risk

Priority: CRITICAL

🏷️ Tags

exploit-available CWE-303

🏢 Vendor Advisories

🔗 https://github.com/coredns/coredns/security/advisori... 🔗 https://github.com/coredns/coredns/security/advisori...

⚡ Actions

🔗 NVD Official Page ⚡ Exploit-DB Search 🐙 GitHub PoC Search 🎯 MITRE ATT&CK 📊 CVE Details

💬 Comments

Loading comments

CVE-2026-33190

💬 Comments

Introduce Yourself

Sign In Required