CVE intelligence

CVE-2026-33190

Vulnerability intelligence

Published May 5, 2026Sources checked Nov 14, 2026

7.5HIGHCVSS out of 10

What this means

Review the available evidence

CVE-2026-33190 and is rated High severity with a CVSS score of 7.5. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

Microsoft Security Response Center guidance

Vendor revision: May 15, 2026

CBL-Mariner Releases

Vendor-listed releases

1.11.4-16

CISA KEVNot listedBased on the latest collected catalog

EPSS0.4%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-33190?

CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the tsig plugin can be bypassed on non-plain-DNS transports (DoT, DoH, DoH3, DoQ, and gRPC) because it trusts the transport writer's TsigStatus() instead of performing verification itself.

The DoH and DoH3 writer's TsigStatus() always returns nil, the DoT server does not set TsigSecret on the dns.Server, and the DoQ and gRPC writers also unconditionally return nil. This allows an unauthenticated remote client to bypass TSIG-based authentication and access resources intended to be restricted behind a tsig require all policy.

Plain DNS over TCP and UDP are not affected. This issue has been fixed in version 1.14.3.

Source: NVD