CVE-2026-33489Disclosure(coredns.io / coredns)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the transfer plugin can select the wrong ACL stanza when both a parent zone and a more-specific subzone are configured. The longestMatch() function in plugin/transfer/transfer.go uses a lexicographic string comparison instead of an actual longest-suffix match to select the winning zone. As a result, a permissive parent-zone transfer rule can override a restrictive subzone rule depending on zone name ordering (e.g., "example.org." > "a.example.org." lexicographically). This allows an unauthorized remote client to perform AXFR/IXFR for the subzone and retrieve its full zone contents. This issue has been fixed in version 1.14.3.

coredns.io CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Exploit / PoC references

Other references

https://github.com/coredns/coredns/releases/tag/v1.14.3

Weakness type (CWE)

CWE-863

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

coredns

Threat summary

5 mentions across 4 observed days
Momentum state: stable

What's happening

Technical details provided in 5 signals
Disclosure: 4 classified signals
General: 1 classified signal
Peaked 2d ago at 2 mentions (2026-05-05); latest day: 1
5 total mentions across 4 days

Affected systems

Vendors

coredns.io

Products

coredns

Deep dive

Activity timeline5 mentions / 4d

Signal classification2 categories

Disclosure

480.0%

General

120.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-29	1	Disclosure1
2026-05-05	2	Disclosure2
2026-05-06	1	Disclosure1
2026-05-08	1	General1

Full discourse5 posts

CVE@CVEnew155d
Disclosure
CVE-2026-33489 CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the transfer plugin can select the wrong ACL stanza when both a parent zone and a more-speci… https://www.cve.org/CVERecord?id=CVE-2026-33489
Post summary
The statement reports a CoreDNS vulnerability (CVE‑2026‑33489) where, in versions prior to 1.14.3, the transfer plugin incorrectly selects an ACL stanza when both a parent zone and a more‑specific child zone coexist.
00010332
57.4K followersView on X
IntegSec@integ_sec153d
General
CVE-2026-33489: CoreDNS Zone Transfer Bypass - What It Means for Your Business and How to Respond https://hubs.li/Q04fZ7wb0
Post summary
The text is a headline referencing CVE-2026-33489 as a CoreDNS zone transfer bypass and promises business‑impact guidance, but it offers no PoC, exploit, active‑exploitation, patch, or detailed technical data.
0000023
30 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds155d
Disclosure
CVE-2026-33489 Unauthorized Zone Transfer in CoreDNS Versions Prior to 1.14.3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-33489
Post summary
The post briefly announces CVE‑2026‑33489, describing an unauthorized zone transfer vulnerability in CoreDNS versions before 1.14.3, without providing a PoC, exploit code, or patch information.
0000041
4.0K followersView on X
Infoflowcloud@infoflowcloud155d
Disclosure
🚨*CVE* CVE-2026-33489 CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the transfer plugin can select the wrong ACL stanza when both a parent zone and a more-speci… https://www.cve.org/CVERecord?id=CVE-2026-33489 ----- Traducción: CVE-2026-33489 Cor… http://infoflow.cloud`
Post summary
This text is a simple disclosure of CVE‑2026‑33489, noting a mis‑selection of ACL stanzas in CoreDNS's transfer plugin, with no evidence of PoC, exploit code, patch, or active exploitation.
00000134
75 followersView on X
DailyCVE@dailycve162d
Disclosure
🔴 CoreDNS, ACL Bypass via Lexicographic Zone Selection, #CVE-2026-33489 (High) https://dailycve.com/coredns-acl-bypass-via-lexicographic-zone-selection-cve-2026-33489-high/
Post summary
A new vulnerability (CVE-2026-33489) affecting CoreDNS’s ACL handling has been disclosed, with mention of the bypass technique but no evidence of exploit code, active attacks, or available patches.
0000080
187 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	coredns.io	coredns	-	-	-

Explore more

Back to dashboard coredns.io CVEs coredns vulnerabilities

What researchers are saying

CVE-2026-33489

IntegSec[verified]@integ_secGeneral

The text is a headline referencing CVE-2026-33489 as a CoreDNS zone transfer bypass and promises business‑impact guidance, but it offers no PoC, exploit, active‑exploitation, patch, or detailed technical data.

CVE@CVEnewDisclosure

The statement reports a CoreDNS vulnerability (CVE‑2026‑33489) where, in versions prior to 1.14.3, the transfer plugin incorrectly selects an ACL stanza when both a parent zone and a more‑specific child zone coexist.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The post briefly announces CVE‑2026‑33489, describing an unauthorized zone transfer vulnerability in CoreDNS versions before 1.14.3, without providing a PoC, exploit code, or patch information.

Infoflowcloud@infoflowcloudDisclosure

This text is a simple disclosure of CVE‑2026‑33489, noting a mis‑selection of ACL stanzas in CoreDNS's transfer plugin, with no evidence of PoC, exploit code, patch, or active exploitation.

DailyCVE@dailycveDisclosure

A new vulnerability (CVE-2026-33489) affecting CoreDNS’s ACL handling has been disclosed, with mention of the bypass technique but no evidence of exploit code, active attacks, or available patches.