CVE-2026-33190

[CVE catalog]

Severity

High · CVSS 8.7

Published

Apr 26, 2026, 10:00:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.37% · Oct 25, 2026

A flaw was found in CoreDNS, a DNS server that chains plugins. An unauthenticated remote client can bypass TSIG (Transaction Signature) based authentication on non-plain-DNS transports such as DNS over TLS (DoT), DNS over HTTPS (DoH), DNS over HTTP/3 (DoH3), DNS over QUIC (DoQ), and gRPC. This bypass occurs because the `tsig` plugin incorrectly trusts the transport writer's status instead of performing its own verification. This allows unauthorized access to resources that should be restricted by TSIG policies. github.com/coredns/coredns: CoreDNS: Authentication bypass via flawed TSIG plugin verification on non-plain-DNS transports The tsig plugin code is compiled into the CoreDNS binary shipped in Red Hat products, but is not enabled in default product configurations. The OpenShift DNS Operator does not include the tsig directive in the generated Corefile, and does not configure non-plain-DNS transport listeners (DoT, DoH, DoH3, DoQ, or gRPC) required to trigger this vulnerability. As a result, the vulnerable code path is not reachable in standard deployments, reducing the practical impact to Low for affected Red Hat products despite the upstream CVSSv3 score of 7.5. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.