# CoreDNS has TSIG authentication bypass on gRPC and QUIC transports

CoreDNS gRPC/QUIC/DoH/DoH3 transports never verify TSIG HMAC, so forged TSIG records bypass auth and allow AXFR zone transfers.

- Payout: Research
- Severity: high
- Program: CoreDNS
- Found by: wnoelll
- Disclosed: 2026-04-28
- CVE: CVE-2026-35579
- Write-up quality: 8/10
- Original: https://github.com/advisories/GHSA-vp29-5652-4fw9
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-vp29-5652-4fw9
- Tags: area:devices domain:network impact:data-leak impact:integrity kind:research platform:ghsa sev:high tech:grpc technique:source-review vuln:access-control vuln:auth-bypass

**Target:** DNS server transports (gRPC, QUIC, DoH, DoH3) with tsig plugin
**Root cause:** gRPC/QUIC only check TSIG key name existence without calling dns.TsigVerify(); DoH/DoH3 hardcode DoHWriter.TsigStatus() to return nil, so any TSIG record is treated as verified.
**Steps:**
1. Configure CoreDNS with `tsig { require all }` and a TSIG key, enable gRPC/QUIC/DoH listeners.
2. Send an AXFR request over gRPC with a valid TSIG key name but forged MAC (e.g. 32 zero bytes).
3. Observe full zone transfer returned instead of BADSIG.
4. For DoH, POST a DNS query with any TSIG record (even bad key name) to `/dns-query`; observe NOERROR instead of NOTAUTH/BADKEY.
**How found:** Reporter compared TSIG handling across transports: TCP path uses dns.Server with real HMAC verification, while gRPC/QUIC/DoH paths manually handle TSIG; noticed key-name-only check and hardcoded nil TsigStatus(), then tested forged MACs against each transport.
**Exploitation:** Unauthenticated network attacker sends AXFR/IXFR or dynamic update requests over gRPC/QUIC with a known key name and garbage MAC, or over DoH/DoH3 with any TSIG record, receiving full zone data.
**Escalation:** DoH/DoH3 variant lowers bar further: no need to know a configured TSIG key name, any TSIG record suffices.
**Insight:** When a protocol feature is reimplemented per-transport, diff each transport's verification path against the canonical one; a hardcoded nil status or key-name-only check is a common shortcut that silently disables auth.