# CVE-2026-33489: CoreDNS incorrect authorization in transfer plugin ACL selection

Source: https://junglewise.ai/threats/cve-2026-33489-coredns-incorrect-authorization-in-transfer-plugin-acl-selection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-05. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-33489 · Severity: high · CVSS 7.5 · Published 2026-05-05

CoreDNS is a widely used DNS server that manages how domain name information is distributed. A security flaw in its zone transfer plugin allows unauthorized users to bypass security restrictions and download the entire contents of a specific domain's database (zone file). This could lead to the exposure of sensitive internal network infrastructure and private records to external attackers.

Technologies: [CoreDNS](https://junglewise.ai/threats/technologies/coredns), [github.com/coredns/coredns (Go)](https://junglewise.ai/threats/technologies/github-com-coredns-coredns). Vendors: [CoreDNS](https://junglewise.ai/threats/vendors/coredns), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-33489 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33489 being exploited in the wild.

**How severe is CVE-2026-33489?** High severity, with a CVSS score of 7.5, published 5 May 2026.

**Which products and versions are affected?** CoreDNS < 1.14.3; github.com/coredns/coredns (Go) SEMVER:introduced=0,fixed=1.14.3.

**Is there a fix for CVE-2026-33489?** Yes. github.com/coredns/coredns (Go): upgrade to 1.14.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33489 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-33489?** Check whether you run CoreDNS or github.com/coredns/coredns (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/coredns/coredns (Go): upgrade to 1.14.3 or later

  ```sh
  go get github.com/coredns/coredns@v1.14.3
  ```


## Technical details

An authorization bypass exists in the CoreDNS 'transfer' plugin due to a logic error in the longestMatch() function within plugin/transfer/transfer.go. Instead of performing a proper longest-suffix match to identify the most specific DNS zone, the function uses a lexicographic string comparison. This allows a permissive Access Control List (ACL) defined for a parent zone (e.g., example.org) to override a more restrictive ACL for a subzone (e.g., a.example.org) if the parent zone name is lexicographically 'greater' than the subzone name. A remote, unauthenticated attacker can exploit this to perform unauthorized AXFR or IXFR requests, resulting in the full disclosure of zone data. The issue is resolved in CoreDNS version 1.14.3.

## Affected products

- CoreDNS CoreDNS < 1.14.3

## Identifiers

- CVE-2026-33489
- GHSA-h8mm-c463-wjq3
- GO-2026-5417

## Timeline

- 2026-04-22: patched: Version 1.14.3 released
- 2026-04-25: advisory: GitHub Security Advisory published
- 2026-05-05: disclosed: CVE published to NVD

## References

- [https://github.com/coredns/coredns/releases/tag/v1.14.3](https://github.com/coredns/coredns/releases/tag/v1.14.3)
- [https://github.com/coredns/coredns/security/advisories/GHSA-h8mm-c463-wjq3](https://github.com/coredns/coredns/security/advisories/GHSA-h8mm-c463-wjq3)

## Related threats

- [CoreDNS RFC 2136 UPDATE bypass in DoH/DoQ/gRPC](https://junglewise.ai/threats/cve-2026-86003-coredns-rfc-2136-update-bypass-in-doh-doq-grpc)
- [CoreDNS unauthenticated memory exhaustion in DoH, DoQ, and DoH3](https://junglewise.ai/threats/cve-2026-82399-coredns-unauthenticated-memory-exhaustion-in-doh-doq-and-doh3)
- [CoreDNS panic in transfer plugin via k8s_external headless services](https://junglewise.ai/threats/cve-2026-62994-coredns-panic-in-transfer-plugin-via-k8s-external-headless)
- [CoreDNS NULL pointer dereference in proxyproto plugin](https://junglewise.ai/threats/cve-2026-62309-coredns-null-pointer-dereference-in-proxyproto-plugin)
- [CoreDNS NULL pointer dereference in rewrite plugin](https://junglewise.ai/threats/cve-2026-62299-coredns-null-pointer-dereference-in-rewrite-plugin)