A critical race condition in CoreDNS allows authenticated users to bypass DNS access control restrictions, potentially leading to unauthorized network visibility.

This is a Time-of-Check Time-of-Use (TOCTOU) race condition (CWE-367) where security plugins like ACL are evaluated before rewrite plugins. An authenticated attacker can exploit this logical flaw to bypass intended access control policies.

The vulnerability permits unauthorized access to restricted DNS records, which may expose internal network infrastructure or facilitate information gathering. Given the CVSS score of 7.7, this represents a significant risk to network security, as attackers can circumvent security boundaries to gain unauthorized visibility into protected services.

Immediate Action: Update the CoreDNS installation to version 1.14.2 or later to resolve the plugin execution order flaw.

Proactive Monitoring: Review DNS query logs for anomalous patterns or unexpected requests originating from low-privilege accounts that should be restricted by ACL policies.

Compensating Controls: Implement network-level segmentation or additional firewall rules to restrict access to the DNS server to known, trusted subnets until the patch is deployed.

Public Exploit Available: Unknown.

The vulnerability poses a high risk to the integrity of DNS-based access controls. Administrators should prioritize the update to version 1.14.2 across all production environments to ensure that security plugins are enforced correctly. Failure to patch may allow attackers to bypass critical security layers, potentially leading to unauthorized information disclosure within the network.