Executive brief
CoreDNS is a widely used DNS server that manages how domain name information is distributed. A security flaw in its zone transfer plugin allows unauthorized users to bypass security restrictions and download the entire contents of a specific domain's database (zone file). This could lead to the exposure of sensitive internal network infrastructure and private records to external attackers.
Technical details
An authorization bypass exists in the CoreDNS 'transfer' plugin due to a logic error in the longestMatch() function within plugin/transfer/transfer.go. Instead of performing a proper longest-suffix match to identify the most specific DNS zone, the function uses a lexicographic string comparison. This allows a permissive Access Control List (ACL) defined for a parent zone (e.g., example.org) to override a more restrictive ACL for a subzone (e.g., a.example.org) if the parent zone name is lexicographically 'greater' than the subzone name. A remote, unauthenticated attacker can exploit this to perform unauthorized AXFR or IXFR requests, resulting in the full disclosure of zone data. The issue is resolved in CoreDNS version 1.14.3.
Affected products
- CoreDNS CoreDNS < 1.14.3
Timeline
- 2026-04-22: patched: Version 1.14.3 released
- 2026-04-25: advisory: GitHub Security Advisory published
- 2026-05-05: disclosed: CVE published to NVD