CoreDNS implements a chain of plugins to process DNS queries. A logical flaw in the default plugin execution order allows the acl plugin to be evaluated before the rewrite plugin. This Time‑of‑Check Time‑of‑Use weakness (CWE‑367) lets an attacker send queries that bypass DNS access controls, potentially exposing zone information or subverting name resolution.

Earlier releases of CoreDNS from coredns.io, up through version 1.14.1 and earlier, are vulnerable. The issue is fixed in version 1.14.2 and later. Systems running a CoreDNS instance without that patch are susceptible to the ACL bypass.

With a CVSS score of 7.7, the flaw poses a high risk. The EPSS score of less than 1 % indicates a low probability of exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need to send DNS queries over the network, but no vulnerability exploits rely on malicious code or elevated privileges; the exploit path is relatively straightforward if the vulnerable plugin order is present.