Publish GHSA-c9v3-4pv7-87pr

Author: advisory-database[bot]

advisories/github-reviewed/2026/03/GHSA-c9v3-4pv7-87pr/GHSA-c9v3-4pv7-87pr.json

@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-c9v3-4pv7-87pr",
+  "modified": "2026-03-06T18:04:00Z",
+  "published": "2026-03-06T18:04:00Z",
+  "aliases": [
+    "CVE-2026-26017"
+  ],
+  "summary": "CoreDNS ACL Bypass",
+  "details": "A logical vulnerability in CoreDNS allows DNS access controls to be bypassed due to the default execution order of plugins. Security plugins such as acl are evaluated before the rewrite plugin, resulting in a Time-of-Check Time-of-Use (TOCTOU) flaw.\n\n\n### Impact\n\nIn multi-tenant Kubernetes clusters, this flaw undermines DNS-based segmentation strategies.\n\nExample scenario:\n1. ACL blocks access to *.admin.svc.cluster.local\n2. A rewrite rule maps public-name → admin.svc.cluster.local\n3. An unprivileged pod queries public-name\n4. ACL allows the request\n5. Rewrite exposes the internal admin service IP\n\nThis allows unauthorized service discovery and reconnaissance of restricted internal infrastructure.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\n### Workarounds\n\n- Reorder the default plugin.cfg so that:\n   - rewrite and other normalization plugins run before acl, opa, and firewall\n- Ensure all access control checks are applied after name normalization.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/coredns/coredns"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.14.2"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/coredns/coredns/security/advisories/GHSA-c9v3-4pv7-87pr"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/coredns/coredns"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/coredns/coredns/releases/tag/v1.14.2"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-367"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-03-06T18:04:00Z",
+    "nvd_published_at": null
+  }
+}