CVE-2026-35579: 
NixOS vulnerability analysis and mitigation

CVE-2026-35579 is a TSIG authentication bypass vulnerability in CoreDNS, a DNS server written in Go. It affects all CoreDNS versions prior to 1.14.3 across four transport implementations: gRPC, QUIC, DoH (DNS-over-HTTPS), and DoH3. The vulnerability was published on May 5, 2026, with the security advisory authored by GitHub user yongtang and credited to researcher wnoelll. It carries a CVSS v3.1 base score of 9.8 (Critical) per NVD, though the GitHub advisory rates it 7.5 (High) with a narrower impact scope (GitHub Advisory).

The root cause is CWE-287 (Improper Authentication): the affected transport layers fail to call dns.TsigVerify() to validate the HMAC of incoming TSIG-signed DNS messages. In server_grpc.go and server_quic.go, the code checks whether the TSIG key name exists in the configuration, but if the key name matches, tsigStatus remains nil — which the tsig plugin interprets as successful verification — without ever verifying the MAC value. The DoH and DoH3 paths are more severe: DoHWriter.TsigStatus() is hardcoded to return nil unconditionally, and neither server_https.go nor server_https3.go inspects the TSIG record at all before passing the message into the plugin chain. This means any DNS request over DoH/DoH3 containing any TSIG record — regardless of key name or MAC content — is treated as fully authenticated (GitHub Advisory).

An unauthenticated network attacker can bypass TSIG authentication to perform AXFR/IXFR zone transfers (exposing full DNS zone data), submit dynamic DNS updates, and trigger other TSIG-gated plugin behavior. For gRPC and QUIC, the attacker must know a valid TSIG key name but can use any arbitrary MAC; for DoH and DoH3, no knowledge of a valid key name is required — any TSIG record suffices. The PoC demonstrated that 6 of 7 forged gRPC requests and 7 of 8 forged DoH requests successfully bypassed authentication and returned complete zone transfer data (GitHub Advisory).

No confirmed in-the-wild exploitation has been observed, and no weaponized exploit code is publicly available — the GitHub advisory contains a PoC description and behavioral table but no runnable exploit (GitHub Advisory). The EPSS score is approximately 0.054%, indicating low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Detection signatures are available via Nessus (plugin 313705) and Qualys (IDs 6763582, 6763376, 918325) (Feedly).

1. Reconnaissance: Identify CoreDNS instances running versions prior to 1.14.3 that expose gRPC (typically port 1443), QUIC, DoH (HTTPS port 443/8443), or DoH3 endpoints. Tools like Shodan or Censys can be used to locate internet-facing CoreDNS deployments.
2. Determine transport target: For DoH/DoH3, no prior knowledge of TSIG key names is needed. For gRPC/QUIC, enumerate or guess a valid TSIG key name (e.g., from DNS zone metadata or configuration leaks).
3. Craft forged TSIG request: Construct a DNS AXFR or dynamic update request and append a TSIG record with an arbitrary or zeroed MAC value. For DoH/DoH3, any TSIG key name (including invalid ones) will be accepted.
4. Send request over affected transport: For DoH, send an HTTPS POST to /dns-query with the forged DNS message. For gRPC, use a gRPC DNS client with the crafted message. The transport layer will call TsigStatus(), which returns nil, and the tsig plugin will treat the request as authenticated.
5. Receive protected data: The server responds with the full zone transfer (AXFR) or processes the dynamic DNS update, bypassing all TSIG-based access controls (GitHub Advisory).

• Network: Unexpected AXFR or IXFR zone transfer requests arriving over DoH (HTTPS POST to /dns-query), gRPC, or QUIC ports from untrusted sources; large DNS responses (full zone data) sent to external or unexpected IP addresses.
• Network: DNS dynamic update requests (opcode UPDATE) received over DoH, DoH3, gRPC, or QUIC transports from unauthenticated or unexpected clients.
• Logs: CoreDNS access logs showing AXFR/IXFR or dynamic update requests over HTTPS, gRPC, or QUIC transports that succeed without corresponding legitimate client activity; TSIG key names in requests that do not match expected client identities (for gRPC/QUIC).
• Logs: Repeated TSIG-authenticated requests over DoH/DoH3 from a single IP or user-agent, especially with varying or malformed TSIG key names.
• File System: Unexpected changes to DNS zone files if dynamic DNS updates were successfully submitted via the bypass (GitHub Advisory).

Upgrade CoreDNS to version 1.14.3 or later, which fixes the vulnerability by ensuring all affected transports call dns.TsigVerify() and store the resulting status before passing messages into the plugin chain (GitHub Advisory). If immediate upgrade is not possible, apply the following workarounds: disable gRPC, QUIC, DoH, and DoH3 listeners on any CoreDNS instance where TSIG authentication is required; restrict network-level access to affected transport ports (e.g., via firewall rules) to trusted sources only; and avoid exposing TSIG-protected functionality such as AXFR, IXFR, or dynamic updates over the affected transports.

The vulnerability was reported by security researcher wnoelll and published via GitHub's security advisory process by CoreDNS maintainer yongtang. The advisory includes a detailed PoC table demonstrating bypass behavior across all four affected transports, which generated attention in vulnerability tracking communities. Coverage appeared across CVE aggregators, Bluesky, and security intelligence platforms shortly after disclosure (GitHub Advisory).