How severe is CVE-2026-33190?

CVE-2026-33190 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2026-33190 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (29th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-33190?

CVE-2026-33190 affects Coredns.io Coredns. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-33190?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2026-33190 have an EU (EUVD) identifier?

Yes. CVE-2026-33190 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-27444.

When was CVE-2026-33190 published?

CVE-2026-33190 was published on 2026-05-05 and last updated on 2026-06-17.

CVE-2026-33190

CVE-2026-33190 is a high-severity vulnerability in Coredns.io Coredns with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-303.

Key facts

Severity: High (CVSS 3.x base score 7.5)
CVSS v4: 8.7
EPSS exploit prediction: 0% (29th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-27444
Weakness: CWE-303
Affected product: Coredns.io Coredns
Published: 2026-05-05
Last modified: 2026-06-17

Description

CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the tsig plugin can be bypassed on non-plain-DNS transports (DoT, DoH, DoH3, DoQ, and gRPC) because it trusts the transport writer's TsigStatus() instead of performing verification itself. The DoH and DoH3 writer's TsigStatus() always returns nil, the DoT server does not set TsigSecret on the dns.Server, and the DoQ and gRPC writers also unconditionally return nil. This allows an unauthenticated remote client to bypass TSIG-based authentication and access resources intended to be restricted behind a tsig require all policy. Plain DNS over TCP and UDP are not affected. This issue has been fixed in version 1.14.3.

Frequently asked questions

What is CVE-2026-33190?: CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the tsig plugin can be bypassed on non-plain-DNS transports (DoT, DoH, DoH3, DoQ, and gRPC) because it trusts the transport writer's TsigStatus() instead of performing verification itself. The DoH and DoH3 writer's TsigStatus() always returns nil, the DoT server does not set TsigSecret on the dns.Server, and the DoQ and gRPC writers also unconditionally return nil. This allows an unauthenticated remote client to bypass TSIG-based authentication and access resources intended to be restricted behind a tsig require all policy. Plain DNS over TCP and UDP are not affected. This issue has been fixed in version 1.14.3.
How severe is CVE-2026-33190?: CVE-2026-33190 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2026-33190 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (29th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-33190?: CVE-2026-33190 affects Coredns.io Coredns. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-33190?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2026-33190 have an EU (EUVD) identifier?: Yes. CVE-2026-33190 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-27444.
When was CVE-2026-33190 published?: CVE-2026-33190 was published on 2026-05-05 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:coredns.io:coredns:*:*:*:*:*:*:*:*

More vulnerabilities in Coredns.io Coredns

CVE-2026-35579 — Critical (CVSS 9.8): CoreDNS is a DNS server written in Go. In versions prior to 1.14.3, the gRPC, QUIC, DoH, and DoH3 transport…
CVE-2026-26017 — High (CVSS 7.7): CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a logical vulnerability in CoreDNS allows DNS…
CVE-2026-33489 — High (CVSS 7.5): CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the transfer plugin can select the wrong ACL…
CVE-2026-32936 — High (CVSS 7.5): CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-HTTPS (DoH) GET path accepts…
CVE-2026-32934 — High (CVSS 7.5): CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-QUIC (DoQ) server can be driven…
CVE-2026-26018 — High (CVSS 7.5): CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a denial of service vulnerability exists in…

All CVEs affecting Coredns.io Coredns →

Other CWE-303 vulnerabilities

CVE-2025-13390 — Critical (CVSS 10.0): The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including,…
CVE-2025-12421 — Critical (CVSS 9.9): Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that…
CVE-2025-12419 — Critical (CVSS 9.9): Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly…
CVE-2025-66489 — Critical (CVSS 9.8): Cal.com is open-source scheduling software. Prior to 5.9.8, A flaw in the login credentials provider allows an attacker…
CVE-2025-21311 — Critical (CVSS 9.8): Windows NTLM V1 Elevation of Privilege Vulnerability
CVE-2024-10127 — Critical (CVSS 9.8): Authentication bypass condition in LDAP authentication in M-Files server versions before 24.11 supported usage of…

Browse all CWE-303 vulnerabilities →