CoreDNS up to 1.14.2 transfer.go longestMatch authorization

Summaryinfo

A vulnerability was found in CoreDNS up to 1.14.2. It has been declared as problematic. Impacted is the function longestMatch of the file plugin/transfer/transfer.go. Executing a manipulation can lead to authorization. The identification of this vulnerability is CVE-2026-33489. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in CoreDNS up to 1.14.2. This vulnerability affects the function longestMatch of the file plugin/transfer/transfer.go. The manipulation with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-863. The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. As an impact it is known to affect confidentiality. CVE summarizes:

CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the transfer plugin can select the wrong ACL stanza when both a parent zone and a more-specific subzone are configured. The longestMatch() function in plugin/transfer/transfer.go uses a lexicographic string comparison instead of an actual longest-suffix match to select the winning zone. As a result, a permissive parent-zone transfer rule can override a restrictive subzone rule depending on zone name ordering (e.g., "example.org." > "a.example.org." lexicographically). This allows an unauthorized remote client to perform AXFR/IXFR for the subzone and retrieve its full zone contents. This issue has been fixed in version 1.14.3.

The advisory is available at github.com. This vulnerability was named CVE-2026-33489 since 03/20/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 313705 (openSUSE 16 Security Update : coredns (openSUSE-SU-2026:20703-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.14.3 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (313705) and EUVD (EUVD-2026-27450). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• CoreDNS

Version

• 1.14.0
• 1.14.1
• 1.14.2

Website

• Product: https://github.com/coredns/coredns/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion