CoreDNS versions prior to 1.14.3 allow an unauthenticated remote client to bypass TSIG authentication over encrypted DNS transports such as DoT, DoH, DoH3, DoQ, and gRPC because the TSIG verification step is delegated to the transport writer’s TsigStatus function, which in these transports either returns nil or does not set a secret. This flaw, classified as CWE-303, permits the attacker to gain access to services that are protected by a tsig require all policy, thereby compromising the confidentiality and integrity of DNS data that were otherwise restricted.

The vulnerability affects the CoreDNS project, with all releases earlier than 1.14.3. Encrypted transports including DNS over TLS, HTTPS, HTTP/3, QUIC, and gRPC are impacted, while plain DNS over TCP and UDP remain unaffected.

The CVSS score of 8.7 reflects a high risk of exploitation. Although an EPSS score is not currently published, the flaw can be exploited remotely without authentication by simply invoking any of the vulnerable encrypted transports. The issue was mitigated in version 1.14.3, which corrects the TSIG verification logic. Until updated, exposed systems are at significant risk of unauthorized data retrieval or modification.