CoreDNS's latest security advisory reveals a deceptively simple logic bug that can let DNS access controls be sidestepped — a Time-of-Check Time-of-Use (TOCTOU) ordering flaw now tracked as CVE-2026-26017 — and while the fix landed quickly in CoreDNS 1.14.2, this vulnerability exposes hardened Kubernetes and multi-tenant deployments to a new class of reconnaissance and segmentation-bypass risks that operators must address immediately.
Background
CoreDNS is the de facto DNS server for many Kubernetes clusters and is widely used as a general-purpose, plugin-driven DNS server. Its architecture is intentionally modular: queries pass through a chain of plugins, each handling responsibilities such as rewriting names, applying access control lists (ACLs), responding from local files, or forwarding upstream. This plugin chain model is powerful but relies on a correct ordering of operations. CVE-2026-26017 is a logic-level vulnerability that arises when normalization or rewriting of names happens after ACL checks instead of before, producing a
TOCTOU-style mismatch between "check" and "use."
The CoreDNS project disclosed the issue and published a patch in release 1.14.2 that reorders the plugin chain so
rewrite and other normalization plugins execute before ACL, OPA, and firewall checks, preventing a path where normalized names expose otherwise-hidden internal resources. The CoreDNS team rated the flaw as
High with a CVSS base score assigned by the vendor at 7.7; other scoring authorities initially produced different numerical assessments, reflecting divergent scoring contexts.
This article summarizes the technical facts, explains how the bypass works in practical Kubernetes scenarios, offers a recommended mitigation and remediation roadmap, and discusses broader implications for DNS-based segmentation strategies in cloud-native environments.
What the vulnerability is — technically
How CoreDNS processes a query
CoreDNS receives a DNS query and processes it through a configured plugin chain. Typical plugins (in order of typical configuration) include:
- protocol handlers (listen/serve)
- normalization or rewriting (plugin: rewrite)
- access control (plugin: acl)
- business logic (kubernetes plugin, file plugin, etc.)
- forwarding or caching (forward, proxy, cache)
The exact order is determined by CoreDNS's configuration (
Corefile) and default
plugin.cfg ordering used by the build.
Where the logic fails
CVE-2026-26017 arises when the ACL plugin is executed
before rewrite or other normalization steps. That ordering creates a
Time-of-Check Time-of-Use (TOCTOU) problem:
- The ACL plugin evaluates the original query name against configured allow/deny rules and makes an access decision (Time-of-Check).
- A later plugin (rewrite or another normalization plugin) modifies the query name — for instance, rewriting a public name to an internal service name — and the modified name is used to resolve the query (Time-of-Use).
- Because the ACL checks occurred on the original name, the normalized/rewritten name may be allowed, even though ACL rules would have denied direct access to the resolved internal name.
This mismatch allows an unprivileged actor (for example, an application pod in Kubernetes) to craft queries that appear allowed by ACLs but resolve to restricted internal hostnames, enabling unauthorized service discovery or exposure of internal IPs.
Example attack flow (concise)
- An environment configures ACLs to block access to
*.admin.svc.cluster.local.
- A rewrite rule maps
public-name.example.com to admin.svc.cluster.local.
- An unprivileged pod queries
public-name.example.com.
- The ACL check runs early and allows
public-name.example.com.
- The rewrite runs after the ACL check and turns the query into
admin.svc.cluster.local.
- The query resolves and the pod receives the internal IP, bypassing the intended ACL.
This is not a memory corruption or injection bug; it is a
logic and ordering error that undermines the assumed semantics of the plugin chain.
Who is affected
- Any CoreDNS installation running versions earlier than 1.14.2 where plugin execution order includes ACL (or equivalent access-control plugins such as OPA/firewall) before rewrite or other normalization plugins.
- Kubernetes clusters that rely on DNS-based segmentation to enforce intra-cluster access controls.
- Multi-tenant platforms and managed Kubernetes providers where tenants share a CoreDNS instance or use shared DNS chains with rewrite rules and ACLs.
- Deployments that use third-party distributions or packaged CoreDNS builds that have not yet adopted the 1.14.2 changes or that override plugin ordering.
The vulnerability is not limited to Kubernetes; any use of CoreDNS with a plugin chain configured in a vulnerable order can be affected. However, the practical risk is highest where DNS is used as a policy enforcement mechanism to separate tenants, protect internal services, or implement service discovery constraints.
Severity and scoring nuance
CoreDNS's advisory assigned a CVSS v3.1 base score of
7.7 (High), reflecting network attack vector, low privileges required, no user interaction, scope change, and high confidentiality impact. At the time of disclosure, other repositories/authorities produced a slightly lower numeric score (for instance, a 6.3 entry appeared in some databases), reflecting differences in scoring assumptions (attack complexity, privileges, or differing interpretations of impact). This numeric divergence is not uncommon for logic and configuration-dependent issues.
What matters operationally is the
qualitative risk: this flaw permits unauthorized information disclosure (internal IPs and service names), undermines segmentation, and can materially change the attack surface within a tenant or cluster. Operators should treat CVE-2026-26017 as a high-priority configuration-integrity vulnerability and act accordingly.
Why this matters: DNS as a control plane
Many cloud-native environments treat DNS as more than name resolution; it's a primitive used for segmentation, policy, and access boundaries. Examples include:
- Using ACLs in CoreDNS to prevent tenant A from resolving tenant B's service names.
- Using rewrite rules to map public hostnames to internal services.
- Implementing DNS-based filtering to hide internal admin endpoints.
When a system relies on DNS for segmentation, a logic bug that changes the identity of the name between check and use fundamentally breaks the trust model. Unlike a simple denial-of-service or cache poisoning issue, a TOCTOU ordering bug allows legitimate-looking queries to produce
legitimately resolved but unauthorized answers — making detection via failed lookups impossible.
This changes the adversary model: an attacker need not exploit a code error or chain complex memory corruptions; they only need to craft queries that take advantage of the plugin ordering.
Mitigation and remediation: what to do now
Operators should follow a prioritized remediation path focusing on risk reduction, verification, and long-term hardening.
Immediate actions (minutes to hours)
- Identify affected CoreDNS instances — inventory all CoreDNS versions across clusters and environments. Any instance running a version earlier than 1.14.2 with ACL and rewrite plugins in play should be considered at risk.
- Apply the 1.14.2 patch — upgrade CoreDNS to version 1.14.2 or later. The vendor patch reorders the plugin pipeline to run rewrite/normalization before ACL checks, closing the bypass.
- Temporarily reorder plugins — if immediate upgrades are not possible, manually reorder the
plugin.cfg or Corefile so that rewrite (and other normalization plugins) execute before acl, opa, and firewall. This is an acceptable short-term workaround.
- Audit ACL and rewrite rules — look for rewrite rules that map public-facing names to internal service names, and ACL entries that target internal names. Prioritize fixes for those configurations.
Short-term actions (hours to days)
- Roll upgrades through CI/CD — treat CoreDNS as a platform dependency. Build and validate upgrades in staging, test plugin ordering, and deploy to production with careful monitoring.
- Add monitoring and alerting — instrument CoreDNS logging to capture queries and plugin processing paths where possible. Alert on unusual query patterns that attempt to map public names into internal namespaces.
- Harden RBAC for DNS configuration — limit which teams or tenants can deploy rewrite rules or modify DNS plugin configuration, as these can now be used as an attack vector.
Medium-term actions (weeks to months)
- Threat-model DNS usage — review where DNS is used as an access-control mechanism and adopt defense-in-depth: network policies, service-mesh mTLS, and Kubernetes NetworkPolicies to supplement DNS-based controls.
- Adopt CI checks for Corefile semantics — include checks that validate plugin ordering in Corefile linting and configuration pipelines.
- Segregate tenant DNS — where possible, give tenants isolated DNS instances or restrict shared rewrite rules to trusted administrators.
Detection: how to know if you've been exploited
This class of vulnerability is stealthy. There are no obvious crash logs or corruption symptoms; successful exploitation simply yields normal DNS responses that are
not supposed to be returned to the requester.
Detection suggestions:
- Search DNS logs for queries that were answered with internal IPs despite originating from unprivileged namespaces or tenant networks.
- Look for unusual query names that map to rewrite rules — especially repeated or patterned queries that attempt to locate
*.admin.svc.cluster.local or other high-value service names.
- Correlate DNS logs with service access logs: unauthorized service discovery often precedes further access attempts. If an unprivileged pod resolved an internal service name and then initiated more interaction attempts, that chain is suspicious.
- Enable or increase verbosity for CoreDNS logs during and immediately after upgrades to capture processing order and plugin actions where possible.
Because exploitation requires only legitimate DNS operations, retrospective detection is challenging — which makes prompt patching the most reliable response.
Attack surface and practical risk scenarios
Multi-tenant Kubernetes control-plane leakage
In shared-hosting or managed Kubernetes, CoreDNS instances sometimes serve multiple tenants or namespaces. If a tenant can submit DNS queries that are rewritten to internal management services, ACLs intended to block access can be subverted. This allows passive reconnaissance (service discovery) and may reveal reachable internal endpoints that can be targeted later.
Service discovery reconnaissance
An attacker may enumerate known public rewrite mappings (for example,
public-*.example) to discover admin endpoints. Once an internal IP is revealed, the attacker can probe for open ports, look for misconfigured services, or attempt lateral movement if other weaknesses exist.
Compounded risk with other vulnerabilities
This vulnerability is a
facilitator rather than an immediate account-takeover bug. When combined with other misconfigurations — permissive network policies, exposed management ports, weak authentication — the information gathered via this bypass can accelerate complex attacks.
Why this bug happened: lessons in plugin architectures
Plugin chains and configurable pipelines are extremely flexible but impose semantic contracts: transformations that change the identity of inputs must occur before policy decisions that rely on that identity. The CoreDNS incident is a textbook example where the default or historically convenient ordering violated that contract.
Key takeaways:
- Normalization-before-policy is a security-first rule: any normalization, canonicalization, or rewriting that changes the meaning of the data should run before policy decisions.
- Defaults matter: many operators rely on defaults. If a default order embeds an insecure assumption, the user base is widely exposed.
- Configuration linting: toolchains should incorporate semantic checks for potentially dangerous plugin orders. A linter could warn if ACLs are configured before rewrite.
Vendor response and timeline
CoreDNS released a fix in version
1.14.2 that reorders the pipeline and provides guidance. The fix was implemented as a direct change to the core: reorder rewrite before acl to prevent bypass (#7882), and the release notes explicitly call out remediation for the ACL bypass.
The advisory included mitigation guidance: reorder the default plugin configuration so normalization plugins run before ACLs, or upgrade. CoreDNS credited the reporter and published updated releases and advisories promptly.
Operators should assume the fix is authoritative and prioritize upgrading to 1.14.2 or later.
Practical upgrade checklist for Kubernetes clusters
- Confirm CoreDNS version:
- In a Kubernetes cluster: kubectl get deployment coredns -n kube-system and check the image tag.
- Stage upgrade:
- Use a canary or staging cluster to upgrade CoreDNS to 1.14.2 and run DNS resolution tests for critical services.
- Validate plugin order:
- Inspect the Corefile and plugin.cfg to ensure rewrite and normalization plugins appear before ACL/OPA/firewall.
- Roll upgrade:
- Use standard kube rolling update or the operator-managed upgrade path for managed control planes.
- Monitor:
- Watch DNS logs and application behavior for any regressions or anomalous patterns following the upgrade.
- Document:
- Record the change and update runbooks for future CoreDNS upgrades and configuration checks.
Broader implications for cloud and platform teams
CVE-2026-26017 is a reminder that seemingly minor semantics — the order of operations — can become a critical security property when infrastructure components are used as policy enforcers. Platform and security teams should:
- Re-evaluate assumptions about control primitives: do not treat name resolution as a hardened policy boundary.
- Layer defenses: use network-level controls and mutual authentication in addition to DNS controls.
- Shift-left configuration validation: embed security checks into CI/CD that verify plugin orders, rewrite rules, and ACL semantics before deployment.
- Centralize observability: DNS events should be visible to security teams alongside network telemetry and application logs.
Risk assessment: strengths and residual concerns
Strengths of the vendor response:
- The CoreDNS project published an explicit release (1.14.2) that addresses the root cause by reordering the plugin chain — a minimal, targeted fix that preserves functionality.
- Advisory guidance included immediate workarounds (reordering), enabling operators who cannot quickly upgrade to mitigate risk.
- The fix is conceptually simple and reduces the chance of regressions compared with large-scale rewrites.
Potential remaining risks:
- Many operators use distribution-provided or vendor-packaged CoreDNS images. Some package maintainers may lag in rolling out version 1.14.2, leaving clusters exposed.
- Manual reordering of plugin.cfg or Corefile is error-prone; misconfiguration during emergency fixes could introduce other logic errors.
- Detection remains difficult; an attacker who used this bypass for reconnaissance may already have harvested internal topology details before the patch is applied.
- Environments that do not separate DNS responsibilities (shared CoreDNS across tenants) remain an architectural risk beyond what a single patch can fully remediate.
Caveat: While authoritative sources confirm the affected versions and the patch, operational exposure varies widely by environment. The numerical CVSS values reported by different authorities diverge due to interpretation differences; operators should prioritize qualitative impact on confidentiality and segmentation over point scores alone.
Recommended long-term platform hardening (summary)
- Treat DNS as an information service, not a single source of truth for access control. Add network segmentation and mTLS-based authorization.
- Isolate DNS instances per trust boundary in multi-tenant environments.
- Automate configuration checks that enforce security-first plugin ordering semantics.
- Harden operator processes so that only vetted administrators can introduce rewrite rules or ACL changes.
- Keep a fast, auditable upgrade path for platform dependencies like CoreDNS.
Conclusion
CVE-2026-26017 is a concise but impactful example of how execution order and normalization semantics can break the security properties operators rely on. The CoreDNS maintainers addressed the issue quickly with a targeted reorder of plugins in version 1.14.2, and practical workarounds are available while upgrades are staged.
For operators, the immediate imperative is clear: inventory CoreDNS versions, upgrade to 1.14.2 or later, and verify that rewrite/normalization plugins run prior to ACLs. Beyond the immediate patching, platform teams must broaden their perspective: DNS is a piece of the trust model, not an unbreakable policy boundary. Layered controls, better configuration validation, and tenant isolation will reduce the chance that similar logic-level bugs create systemic exposure in the future.
Source: MSRC
Security Update Guide - Microsoft Security Response Center