The transfer plugin in CoreDNS versions before 1.14.3 selects the ACL stanza for zone transfers using a lexicographic comparison instead of an actual longest-suffix match. When a parent zone and a more specific subzone are both configured, a permissive ACL defined for the parent may incorrectly win over a restrictive ACL for the subzone. This misselection allows an unauthenticated remote client to request full zone transfers (AXFR or IXFR) for the subzone and retrieve its complete contents, leading to information disclosure. The flaw is a privilege confusion weakness reflected in CWE‑863.

CoreDNS deployments of any vendor that inadvertently rely on the default transfer plugin configuration, specifically all releases prior to 1.14.3, where both a parent zone and a more specific subzone are configured for transfer. The vulnerability applies to the CoreDNS product named CoreDNS, with affected versions listed as any version older than 1.14.3.

The CVSS score of 8.2 indicates a high severity vulnerability that provides remote data disclosure without authentication. EPSS data is not available, and the flaw is not yet listed in CISA’s KEV catalog. The likely attack vector is over the open DNS protocol, requiring an unauthenticated client to perform an AXFR or IXFR request against the vulnerable server. The exploit conditions are minimal: the server must expose zone transfer for the subzone and have the misordered ACL configuration, making the vulnerability readily exploitable in practice.