---
id: CVE-2026-26017
title: CoreDNS is a DNS server that chains plugins
summary: >-
  CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a
  logical vulnerability in CoreDNS allows DNS access controls to be bypassed due
  to the default execution order of plugins. Security plugins such as acl are
  evaluated …
severity: high
cvss: 7.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'
cwe:
  - CWE-367
  - CWE-367
vendor: coredns.io
product: coredns
affected:
  - coredns < 1.14.2
patched:
  - coredns 1.14.2
published: '2026-03-06'
updated: '2026-07-09'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-26017'
references:
  - url: 'https://github.com/coredns/coredns/releases/tag/v1.14.2'
    label: security-advisories@github.com
  - url: 'https://github.com/coredns/coredns/security/advisories/GHSA-c9v3-4pv7-87pr'
    label: security-advisories@github.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:25127'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:36873'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:8151'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/security/cve/CVE-2026-26017'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2445244'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26017.json
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
tags:
  - nvd
epss: 0.00462
epssPercentile: 0.37335
ingestedAt: '2026-07-10T01:55:22.948Z'
---

## Overview

CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a logical vulnerability in CoreDNS allows DNS access controls to be bypassed due to the default execution order of plugins. Security plugins such as acl are evaluated before the rewrite plugin, resulting in a Time-of-Check Time-of-Use (TOCTOU) flaw. This issue has been patched in version 1.14.2.

## Affected

- `coredns < 1.14.2`

## Remediation

Upgrade past the affected range:

- `coredns 1.14.2`