AIKIDO-2026-217866

github.com/coredns/coredns is vulnerable to Improper Access Control

Improper Access Control Pre-CVE Published Yesterday

Medium Risk

This Affects:

github.com/coredns/coredns

1.6.4 - 1.14.6

Fixed in 1.14.7

Are you affected? Scan for Free

TL;DR

The acl plugin allows or denies DNS clients by source address, but its position in the plugin chain lets two response paths sidestep it. Because autopath runs after acl, a query that acl allows is rewritten by autopath into a name in an acl-protected zone that is then resolved without a second acl check. Because cache is ordered before acl, an answer cached for an allowed client is served straight from cache to a client that acl should block. Either way a denied client obtains DNS data the access rules intend to withhold. The fix reorders the directives so acl runs after autopath rewrites and before cache serves answers.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you rely on the acl plugin to restrict clients while also using the autopath or cache plugin.