CVE-2026-26017CWE-367

CoreDNS ACL Bypass

High · published March 6, 2026

CVSS v3.1
7.7
EPSS
0%
Percentile
40.4
In the wild
Unconfirmed
What it is

CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a logical vulnerability in CoreDNS allows DNS access controls to be bypassed due to the default execution order of plugins. Security plugins such as acl are evaluated before the rewrite plugin, resulting in a Time-of-Check Time-of-Use (TOCTOU) flaw. This issue has been patched in version 1.14.2.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00480 · 40.4th percentile
Weakness
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition
Published
2026-03-06T15:36Z
EPSS history
Timeline
  • 06 MAR 15:36Z
    CoreDNS ACL Bypass
    cvelistv5