CVE-2026-26017

Katalog CVE

CVSS 6.3 · Medium EPSS 0,48%

Kerentanan Time-of-check Time-of-use (TOCTOU) Race Condition pada coredns.io coredns. Skor CVSS 3.1 6.3 (Medium) menurut NVD.

Deskripsi (NVD)

CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a logical vulnerability in CoreDNS allows DNS access controls to be bypassed due to the default execution order of plugins. Security plugins such as acl are evaluated before the rewrite plugin, resulting in a Time-of-Check Time-of-Use (TOCTOU) flaw. This issue has been patched in version 1.14.2.

Rincian

Terbit di NVD

6 Maret 2026

Terakhir diubah

15 Juli 2026

Status NVD

Modified

CVSS 3.1

6.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

EPSS (30 hari)

0,48% peluang dieksploitasi; lebih tinggi dari 39,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/coredns/coredns/security/advisories/GHSA-c9v3-4pv7-87pr mitigasi · advisory vendor
• https://github.com/coredns/coredns/releases/tag/v1.14.2 product · release notes
• https://access.redhat.com/errata/RHSA-2026:25127
• https://access.redhat.com/errata/RHSA-2026:36873
• https://access.redhat.com/errata/RHSA-2026:8151
• https://access.redhat.com/security/cve/CVE-2026-26017
• https://bugzilla.redhat.com/show_bug.cgi?id=2445244
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26017.json