CVE-2026-33190
Description
A flaw was found in CoreDNS, a DNS server that chains plugins. An unauthenticated remote client can bypass TSIG (Transaction Signature) based authentication on non-plain-DNS transports such as DNS over TLS (DoT), DNS over HTTPS (DoH), DNS over HTTP/3 (DoH3), DNS over QUIC (DoQ), and gRPC. This bypass occurs because the tsig plugin incorrectly trusts the transport writer's status instead of performing its own verification. This allows unauthorized access to resources that should be restricted by TSIG policies.
Statement
The tsig plugin code is compiled into the CoreDNS binary shipped in Red Hat products, but is not enabled in default product configurations. The OpenShift DNS Operator does not include the tsig directive in the generated Corefile, and does not configure non-plain-DNS transport listeners (DoT, DoH, DoH3, DoQ, or gRPC) required to trigger this vulnerability. As a result, the vulnerable code path is not reachable in standard deployments, reducing the practical impact to Low for affected Red Hat products despite the upstream CVSSv3 score of 7.5.
Mitigation
If you have enabled the tsig plugin in CoreDNS with non-plain-DNS transports (DoT, DoH, DoH3, DoQ, or gRPC), disable those transports or restrict network access to the DNS service until the fix is applied. Plain DNS over TCP and UDP is not affected by this vulnerability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | 7.5 | N/A |
| Attack Vector | Network | Network | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | None | None | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | High | High | N/A |
| Integrity Impact | None | None | N/A |
| Availability Impact | None | None | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
