CVE-2026-33489 CoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparison
Remote attackers can bypass subzone access controls to retrieve full zone data via AXFR/IXFR due to incorrect ACL matching logic in CoreDNS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33489?
CVE-2026-33489 is a high-severity missing authorization vulnerability in coredns, published on 5 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the transfer plugin can select the wrong ACL stanza when both a parent zone and a more-specific subzone are configured. The longestMatch() function in plugin/transfer/transfer.go uses a lexicographic string comparison instead of an actual longest-suffix match to select the winning zone. As a result, a permissive parent-zone transfer rule can override a restrictive subzone rule depending on zone name ordering (e.g., "example.org." > "a.example.org." lexicographically). This allows an unauthorized remote client to perform AXFR/IXFR for the subzone and retrieve its full zone contents. This issue has been fixed in version 1.14.3.
Weakness: CWE-863
Which versions are affected by CVE-2026-33489?
3 open source packages ship an affected version, including github.com/coredns/coredns. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/coredns/coredns Go | All versions | 1.14.3 |
github.com/coredns/coredns Go | All versions | 1.14.3 |
github.com/coredns/coredns Go | All versions | 1.14.3 |
Products include Coredns.io Coredns.
How do I fix CVE-2026-33489?
Upgrade github.com/coredns/coredns to 1.14.3 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-33489 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33489 exists.
Other vulnerabilities in coredns
- CVE-2026-32934 CoreDNS DNS-over-QUIC unbounded goroutine growth leads to denial of service
- CVE-2026-32936 CoreDNS DoH GET path missing size validation causes CPU and memory amplification
- CVE-2026-33190 CoreDNS TSIG authentication bypass on encrypted DNS transports
- CVE-2026-35579 CoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and DoH3 transports
- CVE-2026-26017 CoreDNS ACL Bypass
Sources
Also known as AZL-85721, CLEANSTART-2026-GQ96342, CLEANSTART-2026-XP67395, ECHO-de9e-afd3-21e9, GHSA-h8mm-c463-wjq3, GO-2026-5417 and 20 more.