{
  "cveId": "CVE-2026-26017",
  "url": "https://patchblox.com/security/cve/CVE-2026-26017",
  "summary": "CVE-2026-26017 is fixed in 2 products on 1 platform, first by SUSE-SU-2026:1042-1, released March 25, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "CoreDNS ACL Bypass",
  "description": "This update for coredns fixes the following issues:\n\nChanges in coredns:\n\n- Update to version 1.14.2:\n  * plugin/reload: Allow disabling jitter with 0s\n  * bump deps\n  * plugin/forward: fix parsing error when handling TLS\u002BIPv6 address\n  * plugin/loop: use crypto/rand for query name generation\n  * plugin: reorder rewrite before acl to prevent bypass\n  * fix(rewrite): fix cname target rewrite for CNAME chains\n  * fix(kubernetes): panic on empty ListenHosts\n  * chore: bump minimum Go version to 1.25\n  * feat(proxyproto): add proxy protocol support\n  * refactor(cache): modernize with generics\n  * Add metadata for response Type and Class to Log\n  * docs: clarify kubernetes auth docs\n  * fix: return SOA and NS records when queried for a record CNAMEd to origin\n\n- fixes bsc#1259320 CVE-2026-26017\n- fixes bsc#1259319 CVE-2026-26018\n\n- address more unstable unstable tests under aarch64 and s390x\n\n- Update to version 1.14.1:\n  * This release primarily addresses security vulnerabilities affecting Go\n    versions prior to Go 1.25.6 and Go 1.24.12\n    (CVE-2025-61728, CVE-2025-61726, CVE-2025-68121, CVE-2025-61731,\n     CVE-2025-68119).\n     It also includes performance improvements to the proxy plugin via\n     multiplexed connections, along with various documentation updates.",
  "published": "2026-03-09T14:36:34Z",
  "severity": "Important",
  "cvss": 7.7,
  "cwe": "Time-of-check Time-of-use (TOCTOU) Race Condition",
  "epss": 0.0042,
  "epssPercentile": 0.3664,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26017",
  "fixes": [
    {
      "platform": "linux",
      "product": "coredns",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "1.14.2-bp160.1.1",
      "fix": "OPENSUSE-SU-2026:20619-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-20619-1",
      "released": "2026-04-23T16:09:35Z"
    },
    {
      "platform": "linux",
      "product": "govulncheck-vulndb",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "0.0.20260317T205859-150000.1.152.1",
      "fix": "SUSE-SU-2026:1042-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-1042-1",
      "released": "2026-03-25T15:06:52Z"
    },
    {
      "platform": "linux",
      "product": "govulncheck-vulndb",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "0.0.20260723T184607-160000.1.1",
      "fix": "OPENSUSE-SU-2026:21483-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21483-1",
      "released": "2026-07-30T09:09:47Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-10T13:56:55Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}