8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-35579

CVE-2026-35579: CoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and DoH3 transports

CoreDNS is a DNS server written in Go. In versions prior to 1.14.3, the gRPC, QUIC, DoH, and DoH3 transport implementations incorrectly handle TSIG authentication. For gRPC and QUIC, the server checks whether the TSIG key name exists in the configuration but never calls dns.TsigVerify() to validate the HMAC. If the key name matches a configured key, the tsigStatus field remains nil and the tsig plugin treats the request as successfully authenticated regardless of the MAC value. For DoH and DoH3, the issue is more severe: the DoHWriter.TsigStatus() method unconditionally returns nil, and the server never inspects the TSIG record at all. Any request containing a TSIG record is treated as authenticated over DoH and DoH3, even if the key name is invalid and the MAC is arbitrary.

An unauthenticated network attacker can exploit this to bypass TSIG-protected functionality such as AXFR/IXFR zone transfers, dynamic DNS updates, or other TSIG-gated plugin behavior. The DoH and DoH3 variants have a lower exploitation bar because the attacker does not need to know a valid TSIG key name.

This issue has been fixed in version 1.14.3. As a workaround, disable gRPC, QUIC, DoH, and DoH3 listeners where TSIG authentication is required, or restrict network-level access to affected transport ports to trusted sources only.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-35579

CVE-2026-35579:

8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/coredns/coredns	go	< 1.14.3	1.14.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the improper handling of TSIG (Transaction Signature) authentication across multiple transport protocols in CoreDNS: gRPC, QUIC, DoH, and DoH3. The root cause differs slightly between the protocols.

For DoH (DNS-over-HTTPS) and DoH3, the vulnerability was most severe. The DoHWriter.TsigStatus function was hardcoded to return nil, which falsely signaled to the tsig plugin that every request was successfully authenticated. This meant any request containing a TSIG record, regardless of its validity, would bypass authentication. The fix involved modifying ServerHTTPS.ServeHTTP and ServerHTTPS3.ServeHTTP to perform a full TSIG verification using dns.TsigVerify on the raw DNS message and storing the result, which is then returned by DoHWriter.TsigStatus.

For gRPC and QUIC, the vulnerability was that the server only checked if the TSIG key name existed in its configuration but did not actually verify the cryptographic signature (HMAC) of the message. This allowed an attacker who knew a valid key name to send forged requests that would be accepted as authentic. The fix, applied in ServergRPC.Query and ServerQUIC.serveQUICStream, was to add a call to dns.TsigVerify to ensure the HMAC is validated against the configured secret.

In summary, the identified functions were the entry points for handling requests over the vulnerable transports, and they either completely lacked or had incomplete TSIG verification logic, allowing for an authentication bypass.

Vulnerable functions

ServerHTTPS.ServeHTTP

core/dnsserver/server_https.go

The function was vulnerable because it did not perform any TSIG verification for DoH requests. An attacker could bypass authentication by sending a request with any TSIG record. The patch adds a block to perform full TSIG verification using `dns.TsigVerify`.

DoHWriter.TsigStatus

core/dnsserver/https.go

This function was hardcoded to always return `nil`, indicating successful TSIG verification to the `tsig` plugin, even when no verification was performed. This allowed any DoH request with a TSIG record to be treated as authenticated.

ServerHTTPS3.ServeHTTP

core/dnsserver/server_https3.go

Similar to the DoH transport, the DoH3 transport handler did not perform any TSIG verification. The patch adds the necessary logic to verify the TSIG HMAC using `dns.TsigVerify`.

ServergRPC.Query

core/dnsserver/server_grpc.go

The gRPC transport handler only checked for the existence of the TSIG key name in the configuration but did not verify the HMAC of the TSIG record. This allowed an attacker with knowledge of a valid key name to bypass authentication. The patch adds a call to `dns.TsigVerify` to perform the full verification.

ServerQUIC.serveQUICStream

core/dnsserver/server_quic.go

The QUIC transport handler had the same vulnerability as the gRPC handler. It checked for the TSIG key name's presence but failed to verify the HMAC. An attacker could forge requests with a valid key name to bypass authentication. The patch adds the call to `dns.TsigVerify` to fix this.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.