CVE-2026-33489

CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the transfer plugin can select the wrong ACL stanza when both a parent zone and a more-specific subzone are configured. The longestMatch() function in plugin/transfer/transfer.go uses a lexicographic string comparison instead of an actual longest-suffix match to select the winning zone. As a result, a permissive parent-zone transfer rule can override a restrictive subzone rule depending on zone name ordering (e.g., "example.org." > "a.example.org." lexicographically). This allows an unauthorized remote client to perform AXFR/IXFR for the subzone and retrieve its full zone contents. This issue has been fixed in version 1.14.3.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/coredns/coredns/releases/tag/v1.14.3	Release Notes
https://github.com/coredns/coredns/security/advisories/GHSA-h8mm-c463-wjq3	Exploit Vendor Advisory
https://github.com/coredns/coredns/security/advisories/GHSA-h8mm-c463-wjq3	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:coredns.io:coredns:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-05-05 20:16

Updated : 2026-07-24 23:10

NVD link : CVE-2026-33489

Mitre link : CVE-2026-33489

CVE.ORG link : CVE-2026-33489

JSON object : View

Products Affected

coredns.io

coredns

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-33489", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33489", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-05T19:43:02.806824Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "coredns", "product": "coredns", "versions": [{"status": "affected", "version": "< 1.14.3"}]}]}], "published": "2026-05-05T20:16:36.627", "references": [{"url": "https://github.com/coredns/coredns/releases/tag/v1.14.3", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/coredns/coredns/security/advisories/GHSA-h8mm-c463-wjq3", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/coredns/coredns/security/advisories/GHSA-h8mm-c463-wjq3", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the transfer plugin can select the wrong ACL stanza when both a parent zone and a more-specific subzone are configured. The longestMatch() function in plugin/transfer/transfer.go uses a lexicographic string comparison instead of an actual longest-suffix match to select the winning zone. As a result, a permissive parent-zone transfer rule can override a restrictive subzone rule depending on zone name ordering (e.g., \"example.org.\" > \"a.example.org.\" lexicographically). This allows an unauthorized remote client to perform AXFR/IXFR for the subzone and retrieve its full zone contents. This issue has been fixed in version 1.14.3."}, {"lang": "es", "value": "CoreDNS es un servidor DNS que encadena plugins. En versiones anteriores a la 1.14.3, el plugin de transferencia puede seleccionar la cl\u00e1usula ACL incorrecta cuando se configuran tanto una zona padre como una subzona m\u00e1s espec\u00edfica. La funci\u00f3n longestMatch() en plugin/transfer/transfer.go utiliza una comparaci\u00f3n de cadenas lexicogr\u00e1fica en lugar de una coincidencia de sufijo m\u00e1s largo real para seleccionar la zona ganadora. Como resultado, una regla de transferencia de zona padre permisiva puede anular una regla de subzona restrictiva dependiendo del orden de los nombres de zona (p. ej., 'example.org.' > 'a.example.org.' lexicogr\u00e1ficamente). Esto permite a un cliente remoto no autorizado realizar AXFR/IXFR para la subzona y recuperar el contenido completo de su zona. Este problema ha sido solucionado en la versi\u00f3n 1.14.3."}], "lastModified": "2026-07-24T23:10:00.563", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:coredns.io:coredns:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0B1F8FE2-314C-4C38-9F18-099ACCFF0AAD", "versionEndExcluding": "1.14.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}