CVE-2026-33489 - CoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparison

Back Back to CVE browser

HIGH

CoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparison

Published May 5, 2026

8.2

HIGH

CVSS 4.0

EPSS 0.42%

Description

CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the transfer plugin can select the wrong ACL stanza when both a parent zone and a more-specific subzone are configured. The longestMatch() function in plugin/transfer/transfer.go uses a lexicographic string comparison instead of an actual longest-suffix match to select the winning zone. As a result, a permissive parent-zone transfer rule can override a restrictive subzone rule depending on zone name ordering (e.g., "example.org." > "a.example.org." lexicographically). This allows an unauthorized remote client to perform AXFR/IXFR for the subzone and retrieve its full zone contents. This issue has been fixed in version 1.14.3.

Affected products

Vendor Coredns Product Coredns Default
n/a
- Version
  < 1.14.3
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Coredns

n/a

Version	Status	Constraints
< 1.14.3	affected	-

Red Hat Advanced Cluster Management for Kubernetes 2

rhacm2/lighthouse-agent-rhel9

Fix deferred
Red Hat Advanced Cluster Management for Kubernetes 2

rhacm2/lighthouse-coredns-rhel9

Fix deferred
Red Hat OpenShift Container Platform 4

openshift4/ose-coredns-rhel9

Fix deferred

Product	Package	State	Advisory
Red Hat Advanced Cluster Management for Kubernetes 2	rhacm2/lighthouse-agent-rhel9	Fix deferred	n/a
Red Hat Advanced Cluster Management for Kubernetes 2	rhacm2/lighthouse-coredns-rhel9	Fix deferred	n/a
Red Hat OpenShift Container Platform 4	openshift4/ose-coredns-rhel9	Fix deferred	n/a

Ecosystem	Package	Introduced	Fixed
Go	github.com/coredns/coredns	0	1.14.3

Remediation

Red Hat mitigation

To mitigate this vulnerability, ensure that the CoreDNS `transfer` plugin is configured with explicit and precise Access Control List (ACL) rules for all zones and subzones. Avoid broad parent-zone transfer rules that could inadvertently override more restrictive subzone configurations. If zone transfers are not required, disable the `transfer` plugin or restrict its access to only trusted internal networks using firewall rules or CoreDNS configuration directives. Always review and validate `transfer` plugin configurations to prevent unintended information disclosure.

Weaknesses (3)

CWE-1025

CWE-862

Missing Authorization

CWE-863

Incorrect Authorization

References (8)

https://access.redhat.com/security/cve/CVE-2026-33489
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2466859
Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-27450
Advisory
https://github.com/advisories/GHSA-h8mm-c463-wjq3
Advisory
https://github.com/coredns/coredns/releases/tag/v1.14.3
x_refsource_MISCRelease Notes
https://github.com/coredns/coredns/security/advisories/GHSA-h8mm-c463-wjq3
exploitx_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-33489
https://www.cve.org/CVERecord?id=CVE-2026-33489

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2026-33489		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2466859		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-27450		Advisory
https://github.com/advisories/GHSA-h8mm-c463-wjq3		Advisory
https://github.com/coredns/coredns/releases/tag/v1.14.3		x_refsource_MISCRelease Notes
https://github.com/coredns/coredns/security/advisories/GHSA-h8mm-c463-wjq3		exploitx_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-33489
https://www.cve.org/CVERecord?id=CVE-2026-33489