CVE-2026-33489
CoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparison
Reported by github_m · Published May 5, 2026
CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the transfer plugin can select the wrong ACL stanza when both a parent zone and a more-specific subzone are configured. The longestMatch() function in plugin/transfer/transfer.go uses a lexicographic string comparison instead of an actual longest-suffix match to select the winning zone. As a result, a permissive parent-zone transfer rule can override a restrictive subzone rule depending on zone name ordering (e.g., "example.org." > "a.example.org." lexicographically). This allows an unauthorized remote client to perform AXFR/IXFR for the subzone and retrieve its full zone contents. This issue has been fixed in version 1.14.3.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| eks-distro-fips-1.35 | Chainguard | 1.35.8-r2 |
| k8s_gateway-fips | Chainguard | 1.8.0-r1 |
| eks-distro-fips-1.31 | Chainguard | 1.31.43-r2 |
| eks-distro-fips-1.33 | Chainguard | 1.33.26-r2 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| coredns | coredns | < 1.14.3 |
| chainguard | eks-distro-fips-1.35 | 0 |
| chainguard | k8s_gateway-fips | 0 |
| chainguard | eks-distro-fips-1.31 | 0 |
| chainguard | eks-distro-fips-1.33 | 0 |
| coredns | coredns | 0 |
| chainguard | k8s_gateway | 0 |
| wolfi | kubernetes-dns-node-cache | 0 |
| wolfi | k8s_gateway | 0 |
| chainguard | eks-distro-1.31 | 0 |
| chainguard | eks-distro-1.36 | 0 |
| chainguard | eks-distro-fips-1.34 | 0 |
| chainguard | kubernetes-dns-node-cache-fips | 0 |
| chainguard | eks-distro-fips-1.32 | 0 |
| github.com | coredns/coredns | 0 |
| chainguard | kubernetes-dns-node-cache | 0 |
| chainguard | eks-distro-1.34 | 0 |
| chainguard | eks-distro-1.32 | 0 |
| chainguard | eks-distro-1.33 | 0 |
| wolfi | juicefs-1.3 | 0 |
…and 3 more
Timeline
- Apr 26, 2026 CVE Published
- Apr 28, 2026 CVE Updated
- May 5, 2026 PoC Published
- May 6, 2026 Security Advisory (4 in total, the first dated here)
- May 18, 2026 EPSS Score (30 in total, the first dated here)
- Aug 4, 2026 Coalition ESS Score
- Aug 11, 2026 Distribution Patch
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-33489
vulnetix vdb fixes CVE-2026-33489Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-33489/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/coredns/coredns/security/advisories/GHSA-h8mm-c463-wjq3 x_refsource_CONFIRM
- https://github.com/coredns/coredns/releases/tag/v1.14.3 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-33489 advisory
- https://github.com/advisories/GHSA-h8mm-c463-wjq3 advisory
- https://github.com/coredns/coredns url