CVE-2026-33489: 
NixOS vulnerability analysis and mitigation

CVE-2026-33489 is an authorization bypass vulnerability in CoreDNS's transfer plugin, allowing unauthorized remote clients to perform AXFR/IXFR zone transfers and retrieve full zone contents for subzones. It affects all CoreDNS versions prior to 1.14.3 and was published on April 25, 2026, with a fix released in v1.14.3. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.2 (High) (GitHub Advisory, CoreDNS Release).

The root cause lies in the longestMatch() function within plugin/transfer/transfer.go, which is documented to select the most specific (longest) zone match but instead performs a simple lexicographic string comparison (if z > zone). This means a parent zone such as example.org. can lexicographically outrank a more-specific child zone like a.example.org. (since "example.org." > "a.example.org." lexicographically), causing a permissive parent-zone ACL to override a restrictive subzone ACL. The vulnerability is classified as CWE-862 (Missing Authorization) and CWE-863 (Incorrect Authorization), and exploitation requires no authentication, no user interaction, and is reachable over the network. The bypass is data-dependent — whether a child zone label wins or loses depends on the specific zone names configured — making it operationally non-intuitive (GitHub Advisory, GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to perform AXFR or IXFR zone transfers for a subzone that was intended to be restricted, exposing the full DNS zone contents to unauthorized parties. This can reveal internal hostnames, IP addresses, mail server configurations, and other sensitive infrastructure details that could facilitate reconnaissance and further attacks such as targeted phishing or lateral movement. There is no integrity or availability impact; the vulnerability is purely a confidentiality concern (GitHub Advisory).

A Python proof-of-concept script (acl-repro.py) is publicly available in the CoreDNS security advisory, demonstrating the ACL bypass by configuring CoreDNS with specific transfer rules and executing AXFR queries to confirm the vulnerability (GitHub Advisory). As of the time of reporting, there is no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.016% (4th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Reconnaissance: Identify CoreDNS instances running versions prior to 1.14.3 that are configured with both a parent zone (e.g., example.org.) with a permissive transfer rule and a subzone (e.g., a.example.org.) with a restrictive transfer rule.
2. Verify configuration vulnerability: Confirm that the parent zone name is lexicographically greater than the subzone name (e.g., "example.org." > "a.example.org."), which is the condition that triggers the ACL bypass.
3. Send AXFR/IXFR request: Using a DNS tool such as dig or a custom script, send a zone transfer request targeting the restricted subzone: dig AXFR a.example.org. @<target-coredns-ip>.
4. Observe bypass: Due to the incorrect longestMatch() logic, CoreDNS applies the permissive parent-zone ACL instead of the restrictive subzone ACL, returning NOERROR with full zone records (ancount > 0) rather than REFUSED.
5. Retrieve zone data: Collect all DNS records from the zone transfer response, including hostnames, IP addresses, MX records, and other infrastructure details for further reconnaissance or attack planning (GitHub Advisory).

• Network: Unexpected AXFR or IXFR DNS requests (TCP port 53) to CoreDNS servers originating from unauthorized or external IP addresses; DNS responses with high answer counts (ancount > 0) for zone transfer queries from non-authorized clients.
• Logs: CoreDNS query logs showing AXFR/IXFR requests for subzones from unexpected source IPs that receive NOERROR responses instead of REFUSED; repeated zone transfer attempts from a single external IP.
• Network: Unusually large DNS TCP sessions indicative of full zone transfer data being transmitted to unauthorized clients.

The primary remediation is to upgrade CoreDNS to version 1.14.3 or later, which fixes the longestMatch() function in plugin/transfer/transfer.go to correctly select the most specific zone using proper longest-suffix matching (CoreDNS Release). As a workaround prior to patching, administrators should implement network-level controls (e.g., firewall rules) to restrict AXFR/IXFR requests (TCP port 53) to only authorized secondary DNS servers. Additionally, review all zone transfer ACL configurations to identify parent/subzone combinations where the parent zone name is lexicographically greater than the subzone name, and consider temporarily removing permissive parent-zone transfer rules until the patch is applied (GitHub Advisory).

The vulnerability was reported by researcher manizada and published by CoreDNS maintainer yongtang on April 25, 2026. The fix was incorporated into the v1.14.3 release alongside several other security and stability improvements. Detection signatures have been added by Nessus (plugin 313705) and Qualys, indicating prompt uptake by the vulnerability management community (GitHub Advisory, CoreDNS Release).