Tóm tắt nhanh
- CVE-2026-26017 là lỗ hổng mức TRUNG BÌNH (CVSS 6.3) ảnh hưởng github.com/coredns/coredns, coredns (coredns.io).
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.42%, cao hơn 36.4% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 1.14.2 hoặc mới hơn.
Mô tả
A logical vulnerability in CoreDNS allows DNS access controls to be bypassed due to the default execution order of plugins. Security plugins such as acl are evaluated before the rewrite plugin, resulting in a Time-of-Check Time-of-Use (TOCTOU) flaw.
Impact
In multi-tenant Kubernetes clusters, this flaw undermines DNS-based segmentation strategies.
Example scenario:
- ACL blocks access to *.admin.svc.cluster.local
- A rewrite rule maps public-name → admin.svc.cluster.local
- An unprivileged pod queries public-name
- ACL allows the request
- Rewrite exposes the internal admin service IP
This allows unauthorized service discovery and reconnaissance of restricted internal infrastructure.
Patches
Has the problem been patched? What versions should users upgrade to?
Workarounds
- Reorder the default plugin.cfg so that:
- rewrite and other normalization plugins run before acl, opa, and firewall
- Ensure all access control checks are applied after name normalization.
Mô tả của NVD
CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a logical vulnerability in CoreDNS allows DNS access controls to be bypassed due to the default execution order of plugins. Security plugins such as acl are evaluated before the rewrite plugin, resulting in a Time-of-Check Time-of-Use (TOCTOU) flaw. This issue has been patched in version 1.14.2.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí