What is CVE-2026-35579?

CVE-2026-35579 is a critical-severity vulnerability in Coredns, classified under Improper Authentication. CVSS score: 9.8/10. Published 2026-05-05.

How severe is CVE-2026-35579?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Auth bypass in Coredns

CVE-2026-35579

CoreDNS is a DNS server written in Go. In versions prior to 1.14.3, the gRPC, QUIC, DoH, and DoH3 transport implementations incorrectly handle TSIG authentication. For gRPC and QUIC, the server checks whether the TSIG key name exists in th…

Vulnerability class: Broken Authentication

EPSS: 0.001 (21.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Coredns — versions < 1.14.3
Coredns.io Coredns

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

https://github.com/coredns/coredns/security/advisories/GHSA-vp29-5652-4fw9 (x_refsource_CONFIRM, Exploit, Mitigation, Vendor Advisory)

Frequently asked questions

What is CVE-2026-35579?: CVE-2026-35579 is a critical-severity vulnerability in Coredns, classified under Improper Authentication. CVSS score: 9.8/10. Published 2026-05-05.
How severe is CVE-2026-35579?: Critical severity. CVSS v3 base score is 9.8 out of 10.