DNS Server Vulnerability in CoreDNS Affects Plugin Functionality
CVE-2026-33489

8.2HIGH

Key Information:

Vendor

Coredns

Status
Coredns
Vendor
CVE Published:
5 May 2026

What is CVE-2026-33489?

CoreDNS, a versatile DNS server with plugin capabilities, features a vulnerability in its transfer plugin prior to version 1.14.3. The issue arises from how the server processes Access Control Lists (ACLs) when both a parent zone and a more-specific subzone are defined. Instead of employing a proper longest-suffix match, the longestMatch() function utilizes a lexicographic comparison, leading to the potential for a permissive parent-zone transfer rule to supersede a more restrictive subzone rule. As a result, unauthorized remote clients may exploit this weakness to execute AXFR or IXFR requests on affected subzones, exposing sensitive zone content based on the lexicographic order of zone names. The flaw has been rectified in version 1.14.3. For further details, refer to the security advisories and release notes.

Affected Version(s)

coredns < 1.14.3

References

https://github.com/coredns/coredns/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/coredns/coredns/releases/tag/v1.14.3
x_refsource_MISC

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.