CVE-2026-26017: 
NixOS vulnerability analysis and mitigation

CVE-2026-26017 is a DNS access control bypass vulnerability in CoreDNS, a widely used DNS server that chains plugins. The flaw stems from a logical error in the default plugin execution order: security plugins such as acl are evaluated before the rewrite plugin, creating a Time-of-Check Time-of-Use (TOCTOU) condition that allows DNS access controls to be circumvented. All CoreDNS versions prior to 1.14.2 are affected; the issue was disclosed and patched on March 6, 2026. It carries a CVSS v3.1 base score of 7.7 (High) per the GitHub Security Advisory, with a network attack vector and low privileges required (Github Advisory, CoreDNS Advisory).

The root cause is a logical design flaw (CWE-367: Time-of-Check Time-of-Use Race Condition) in CoreDNS's default plugin chain ordering defined in plugin.cfg. Because acl (and similar security plugins such as opa and firewall) execute before the rewrite plugin, an attacker can craft a DNS query using a publicly accessible name that passes ACL evaluation, after which the rewrite plugin transforms the query to resolve a restricted internal name — effectively bypassing the access control check. The fix, committed as "core: Reorder rewrite before acl to prevent bypass (#7882)", ensures name normalization occurs prior to access control evaluation. No complex exploitation primitives are required beyond the ability to send DNS queries with low-privilege credentials (Github Advisory, CoreDNS Release).

Successful exploitation allows an authenticated attacker with low privileges to bypass DNS-based access controls and resolve internal DNS names that should be restricted. In multi-tenant Kubernetes environments, this undermines DNS-based network segmentation: an unprivileged pod can query a public-facing name that is rewritten to a restricted internal service (e.g., *.admin.svc.cluster.local), enabling unauthorized service discovery and reconnaissance of internal infrastructure. The impact is limited to confidentiality (high), with no integrity or availability consequences, but the scope change means resources outside the vulnerable component's security boundary are affected (Github Advisory, CoreDNS Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.021% (6th percentile), indicating a low near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Microsoft has also acknowledged the vulnerability as affecting Azure Linux (AZL3 and CBL2) CoreDNS packages (Microsoft).

1. Reconnaissance: Identify a CoreDNS deployment (version < 1.14.2) that uses both the rewrite and acl (or similar security) plugins, particularly in a multi-tenant Kubernetes cluster where DNS-based segmentation is enforced.
2. Identify ACL-protected names: Determine which internal DNS names are blocked by ACL rules (e.g., *.admin.svc.cluster.local) by attempting direct queries and observing REFUSED responses.
3. Identify rewrite rules: Review or infer CoreDNS rewrite rules that map public-facing names to restricted internal names (e.g., a rule mapping public-service.example.com → admin.svc.cluster.local).
4. Craft bypass query: From an unprivileged pod or low-privilege account, send a DNS query for the public-facing name (e.g., public-service.example.com) that is subject to a rewrite rule pointing to the restricted zone.
5. Bypass ACL: The ACL plugin evaluates the original query name (public-service.example.com), finds no matching block rule, and allows the request. The rewrite plugin then transforms the name to the restricted internal address.
6. Obtain restricted DNS response: CoreDNS resolves and returns the IP address of the restricted internal service, enabling the attacker to discover and potentially connect to internal infrastructure (Github Advisory, CoreDNS Advisory).

• Network: DNS queries from unprivileged pods or low-privilege accounts resolving names that map (via rewrite rules) to ACL-restricted internal zones; successful DNS responses for names that should return REFUSED.
• Logs: CoreDNS query logs showing successful resolution of public-facing names that correspond to rewrite targets pointing to restricted namespaces (e.g., *.admin.svc.cluster.local); absence of REFUSED log entries for queries that should have been blocked.
• Behavioral: Unusual DNS query patterns from pods in non-privileged namespaces targeting service names associated with administrative or sensitive internal services; repeated queries for names matching known rewrite rules from unexpected sources.

The primary remediation is to upgrade CoreDNS to version 1.14.2 or later, which reorders the plugin chain so that rewrite executes before acl, opa, and firewall plugins (CoreDNS Release). Note that the GitHub Security Advisory page references version 1.14.3 as the patched version for the advisory entry, so upgrading to the latest available release is recommended. As a configuration-based workaround for environments that cannot immediately upgrade, administrators should manually reorder plugin.cfg so that rewrite and other name normalization plugins run before all access control plugins, ensuring ACL checks are applied after name transformation (Github Advisory). Microsoft has released updated packages for Azure Linux (AZL3 and CBL2) to address this vulnerability (Microsoft). OpenSUSE has also issued security announcements for affected CoreDNS packages.

The vulnerability was reported by YOUNEVSKY and verified by thevilledev, with the fix published by CoreDNS maintainer yongtang (CoreDNS Advisory). Red Hat tracked the issue via Bugzilla and classified it as high severity, with product security teams engaged (Red Hat Bugzilla). The vulnerability received coverage in the context of Microsoft's March 2026 Patch Tuesday, which addressed 79 vulnerabilities including this CoreDNS issue affecting Azure Linux distributions. Community discussion was noted on social platforms including Mastodon and Bluesky, and OpenSUSE issued multiple security announcements for affected packages.