Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the tsig plugin can be bypassed on non-plain-DNS transports (DoT, DoH, DoH3, DoQ, and gRPC) because it trusts the transport writer's TsigStatus() instead of performing verification itself. The DoH and DoH3 writer's TsigStatus() always returns nil, the DoT server does not set TsigSecret on the dns.Server, and the DoQ and gRPC writers also unconditionally return nil. This allows an unauthenticated remote client to bypass TSIG-based authentication and access resources intended to be restricted behind a tsig require all policy. Plain DNS over TCP and UDP are not affected. This issue has been fixed in version 1.14.3.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-29 | 1 | Disclosure1 |
| 2026-04-30 | 1 | Disclosure1 |
| 2026-05-05 | 2 | Disclosure2 |
| 2026-05-06 | 1 | General1 |
| 2026-05-13 | 1 | Patch1 |
Critical DNS flaws: Windows DNS Client RCE (CVE-2026-41096), dnsmasq bugs, & CoreDNS TSIG bypass (CVE-2026-33190) expose data privacy & integrity in transit. Patch ASAP! #Cybersecurity #NetworkSecurity #DNS
Post summary
The tweet alerts to newly disclosed DNS vulnerabilities affecting Windows DNS Client and CoreDNS, stressing the need for urgent patching.
CVE-2026-33190 CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the tsig plugin can be bypassed on non-plain-DNS transports (DoT, DoH, DoH3, DoQ, and gRPC) … https://www.cve.org/CVERecord?id=CVE-2026-33190
Post summary
The post announces CVE-2026-33190, detailing that CoreDNS versions before 1.14.3 allow attackers to bypass the tsig plugin on secure DNS transports, but it does not mention PoC, exploitation tools, patches, or false positives.
Unpopular opinion: The cybersecurity industry is selling you dashboards. The DNS Foundation Cracks: CoreDNS CVE-2026-33190 Exposes TSIG Auth Bypass on Modern Transports
Post summary
The post references CoreDNS CVE‑2026‑33190 as a TSIG authentication bypass in modern transports, but provides no PoC, exploit tool, active usage, or patch information.
CVE-2026-33190 TSIG Authentication Bypass in CoreDNS Versions Prior to 1.14.3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-33190
Post summary
The post briefly references CVE-2026-33190, noting a TSIG authentication bypass in CoreDNS before v1.14.3, and links to a external vulnerability details page.
🚨*CVE* CVE-2026-33190 CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the tsig plugin can be bypassed on non-plain-DNS transports (DoT, DoH, DoH3, DoQ, and gRPC) … https://www.cve.org/CVERecord?id=CVE-2026-33190 ----- Traducción: CVE-2026-33190 Cor… http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑33190, describing a tsig plugin bypass on various secure DNS transports, without mentioning PoC, exploit code, patches, or active exploitation.
🔴 CoreDNS, TSIG Authentication Bypass, #CVE-2026-33190 (High) https://dailycve.com/coredns-tsig-authentication-bypass-cve-2026-33190-high/
Post summary
A newly disclosed CoreDNS TSIG authentication bypass (CVE‑2026‑33190) is announced with high severity, but no PoC, exploit, patch, or evidence of active exploitation is provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | coredns.io | coredns | - | - | - |