https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Fri, 18 Sep 2026 10:43:22 +0000 https://vulnerability.circl.lu/sighting/74860213-dc46-4ac2-9a46-d07081d8fe00/export {"uuid": "74860213-dc46-4ac2-9a46-d07081d8fe00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86003", "type": "seen", "source": "https://gist.github.com/alon710/e7a608459f9cd16dd9b84291002561e5", "content": "# CVE-2026-86003: CVE-2026-86003: Unintended Proxying of DNS UPDATE Requests via Alternative Transports in CoreDNS\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-86003\n\n## Summary\nA protocol-level validation bypass in CoreDNS versions prior to 1.14.7 allows unauthenticated remote attackers to proxy unauthorized DNS UPDATE messages (Opcode 5) using modern alternative transport layers such as DoH, DoH3, DoQ, and gRPC. If upstream authoritative servers trust the CoreDNS server's source IP and do not enforce TSIG authentication, attackers can inject, alter, or delete DNS zone records, leading to potential zone takeover or traffic redirection.\n\n## TL;DR\nCoreDNS alternative transports failed to enforce default message acceptance policies on DNS headers, allowing remote attackers to send unauthorized DNS UPDATE queries that are forwarded to trusting upstream resolvers.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-441\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 7.5 (High)\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n- **Impact**: High Integrity Impact (Zone manipulation)\n\n## Affected Systems\n\n- CoreDNS\n\n## Mitigation\n\n- Upgrade CoreDNS to version 1.14.7 or later.\n- Disable alternative transports (DoH, DoQ, gRPC) if not strictly required.\n- Enforce Transaction Signatures (TSIG) on upstream authoritative name servers to prevent unauthenticated updates.\n\n**Remediation Steps:**\n1. Audit current CoreDNS deployment versions using 'coredns -version' or checking Kubernetes container images.\n2. Apply the v1.14.7 update package or patch the container image in the deployment configuration.\n3. Verify the Corefile configuration to identify and temporarily comment out alternative listeners (like 'doh', 'grpc') if upgrading cannot be done immediately.\n4. Update upstream DNS servers (such as BIND, Windows DNS) to mandate cryptographic TSIG keys for all Dynamic Updates instead of relying solely on IP allowlists.\n\n## References\n\n- [GitHub Security Advisory GHSA-9gm5-9rfh-m6vx](https://github.com/coredns/coredns/security/advisories/GHSA-9gm5-9rfh-m6vx)\n- [NVD - CVE-2026-86003](https://nvd.nist.gov/vuln/detail/CVE-2026-86003)\n- [CVE.org Record for CVE-2026-86003](https://www.cve.org/CVERecord?id=CVE-2026-86003)\n- [CoreDNS Bug Fix Commit](https://github.com/coredns/coredns/commit/530b0a5ff2ad68cc0421f10dd93568945cc671c9)\n- [CoreDNS Release v1.14.7](https://github.com/coredns/coredns/releases/tag/v1.14.7)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-86003) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-18T04:31:38.422948Z"} {"uuid": "74860213-dc46-4ac2-9a46-d07081d8fe00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86003", "type": "seen", "source": "https://gist.github.com/alon710/e7a608459f9cd16dd9b84291002561e5", "content": "# CVE-2026-86003: CVE-2026-86003: Unintended Proxying of DNS UPDATE Requests via Alternative Transports in CoreDNS\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-86003\n\n## Summary\nA protocol-level validation bypass in CoreDNS versions prior to 1.14.7 allows unauthenticated remote attackers to proxy unauthorized DNS UPDATE messages (Opcode 5) using modern alternative transport layers such as DoH, DoH3, DoQ, and gRPC. If upstream authoritative servers trust the CoreDNS server's source IP and do not enforce TSIG authentication, attackers can inject, alter, or delete DNS zone records, leading to potential zone takeover or traffic redirection.\n\n## TL;DR\nCoreDNS alternative transports failed to enforce default message acceptance policies on DNS headers, allowing remote attackers to send unauthorized DNS UPDATE queries that are forwarded to trusting upstream resolvers.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-441\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 7.5 (High)\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n- **Impact**: High Integrity Impact (Zone manipulation)\n\n## Affected Systems\n\n- CoreDNS\n\n## Mitigation\n\n- Upgrade CoreDNS to version 1.14.7 or later.\n- Disable alternative transports (DoH, DoQ, gRPC) if not strictly required.\n- Enforce Transaction Signatures (TSIG) on upstream authoritative name servers to prevent unauthenticated updates.\n\n**Remediation Steps:**\n1. Audit current CoreDNS deployment versions using 'coredns -version' or checking Kubernetes container images.\n2. Apply the v1.14.7 update package or patch the container image in the deployment configuration.\n3. Verify the Corefile configuration to identify and temporarily comment out alternative listeners (like 'doh', 'grpc') if upgrading cannot be done immediately.\n4. Update upstream DNS servers (such as BIND, Windows DNS) to mandate cryptographic TSIG keys for all Dynamic Updates instead of relying solely on IP allowlists.\n\n## References\n\n- [GitHub Security Advisory GHSA-9gm5-9rfh-m6vx](https://github.com/coredns/coredns/security/advisories/GHSA-9gm5-9rfh-m6vx)\n- [NVD - CVE-2026-86003](https://nvd.nist.gov/vuln/detail/CVE-2026-86003)\n- [CVE.org Record for CVE-2026-86003](https://www.cve.org/CVERecord?id=CVE-2026-86003)\n- [CoreDNS Bug Fix Commit](https://github.com/coredns/coredns/commit/530b0a5ff2ad68cc0421f10dd93568945cc671c9)\n- [CoreDNS Release v1.14.7](https://github.com/coredns/coredns/releases/tag/v1.14.7)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-86003) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-18T04:31:38.422948Z"} https://vulnerability.circl.lu/sighting/74860213-dc46-4ac2-9a46-d07081d8fe00/export Fri, 18 Sep 2026 04:31:38 +0000 https://vulnerability.circl.lu/sighting/87f29b5c-fe94-4c22-b1bf-fd86b27b741c/export {"uuid": "87f29b5c-fe94-4c22-b1bf-fd86b27b741c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-86003", "type": "published-proof-of-concept", "source": "https://github.com/coredns/coredns/security/advisories/GHSA-9gm5-9rfh-m6vx", "content": "", "creation_timestamp": "2026-09-17T22:35:09.651050Z"} {"uuid": "87f29b5c-fe94-4c22-b1bf-fd86b27b741c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-86003", "type": "published-proof-of-concept", "source": "https://github.com/coredns/coredns/security/advisories/GHSA-9gm5-9rfh-m6vx", "content": "", "creation_timestamp": "2026-09-17T22:35:09.651050Z"} https://vulnerability.circl.lu/sighting/87f29b5c-fe94-4c22-b1bf-fd86b27b741c/export Thu, 17 Sep 2026 22:35:09 +0000