7.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-26017

CVE-2026-26017: CoreDNS ACL Bypass

CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a logical vulnerability in CoreDNS allows DNS access controls to be bypassed due to the default execution order of plugins. Security plugins such as acl are evaluated before the rewrite plugin, resulting in a Time-of-Check Time-of-Use (TOCTOU) flaw. This issue has been patched in version 1.14.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-26017

CVE-2026-26017:

7.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/coredns/coredns	go	< 1.14.2	1.14.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Time-of-Check Time-of-Use (TOCTOU) flaw resulting from the default plugin execution order in CoreDNS. The security advisory and the associated patch confirm that the acl plugin was being executed before the rewrite plugin. This allowed an attacker to craft a DNS query for a domain that is permitted by the ACLs. After the acl plugin's ServeDNS method approved the query, the rewrite plugin's ServeDNS method would then modify the query to point to a restricted internal service, bypassing the intended security policy.

The patch, found in commit e4b9a976441491881377947a200f414c7961e936, addresses this by modifying the plugin.cfg file to reorder the plugins, placing rewrite before acl. This ensures that any name rewriting occurs before the access control check is performed, so the ACL is evaluated against the final, potentially sensitive, domain name.

Therefore, the functions ACL.ServeDNS and Rewrite.ServeDNS are the key runtime indicators of this vulnerability. During an exploit scenario on a vulnerable version, a profiler would show ACL.ServeDNS executing and allowing a request, followed by Rewrite.ServeDNS modifying it to access a restricted resource.

Vulnerable functions

ACL.ServeDNS

plugin/acl/acl.go

The vulnerability is not in the function's code itself, but in its execution order. In the vulnerable configuration, this function performs an access control check on a DNS query *before* the query name is rewritten. A malicious actor can send a query for an allowed name, which passes this check, and then the 'rewrite' plugin changes it to a restricted name, bypassing the intended access control. This function would appear in a runtime profile as it's the point of the ineffective security check.

Rewrite.ServeDNS

plugin/rewrite/rewrite.go

This function is part of the vulnerable execution chain. In the vulnerable configuration, it rewrites a DNS query name *after* the 'acl' plugin has already approved it. This allows a query for an innocuous name to be transformed into a query for a sensitive internal service, effectively causing the ACL bypass. This function is the enabler of the bypass and would appear in a runtime profile during exploitation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.