8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33489

CVE-2026-33489: CoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparison

CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the transfer plugin can select the wrong ACL stanza when both a parent zone and a more-specific subzone are configured. The longestMatch() function in plugin/transfer/transfer.go uses a lexicographic string comparison instead of an actual longest-suffix match to select the winning zone. As a result, a permissive parent-zone transfer rule can override a restrictive subzone rule depending on zone name ordering (e.g., "example.org." > "a.example.org." lexicographically). This allows an unauthorized remote client to perform AXFR/IXFR for the subzone and retrieve its full zone contents. This issue has been fixed in version 1.14.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33489

CVE-2026-33489:

8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/coredns/coredns	go	< 1.14.3	1.14.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the transfer plugin of CoreDNS, specifically within the longestMatch function located in plugin/transfer/transfer.go. The function's purpose is to select the correct Access Control List (ACL) stanza based on the most specific matching zone. The vulnerability was introduced because the implementation used a lexicographical string comparison (if z > zone) to determine the 'longest' match. This is incorrect because a shorter parent domain (e.g., example.org.) can be lexicographically greater than a longer, more specific subdomain (e.g., a.example.org.). As a result, a permissive ACL on a parent domain could override a restrictive ACL on a subdomain, allowing unauthorized zone transfers (AXFR/IXFR).

The patch for this vulnerability, found in commit 9b57778db26452e50d40e97d5f7a99f7c0211300, corrects this logic by changing the comparison to if len(z) > len(zone). This ensures that the function correctly selects the zone with the longest string length, which corresponds to the most specific DNS zone, thus correctly enforcing the intended ACLs. The vulnerable function, transfer.longestMatch, is the key runtime indicator for this vulnerability.

Vulnerable functions

transfer.longestMatch

plugin/transfer/transfer.go

The function `longestMatch` in `plugin/transfer/transfer.go` was intended to select the most specific zone for applying transfer ACLs. However, it used a lexicographical comparison (`z > zone`) instead of comparing the length of the zone names. This could cause a less specific, but lexicographically larger, parent zone's ACL to be chosen over a more specific subzone's ACL, leading to an ACL bypass.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.