The vulnerability of the tsig DNS server plugin from coredns allows attackers to circumvent security restrictions and gain unauthorized access to protected information.

The vulnerability of the tsig DNS server plugin from coredns is related to the improper implementation of the authentication algorithm. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and gain unauthorized access to protected information...

CVE-2026-33190: Incorrect Implementation of Authentication Algorithm

CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the tsig plugin can be bypassed on non-plain-DNS transports DoT, DoH, DoH3, DoQ, and gRPC because it trusts the transport writer's TsigStatus instead of performing verification itself. The DoH and DoH3 writer's TsigStatus...

Missing Authentication for Critical Function

Overview github.com/coredns/coredns/core/dnsserver is a package that implements all the interfaces from Caddy, so that CoreDNS can be a servertype plugin. Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the tsig plugin on non-plain-DNS...