{
  "id": 14465958,
  "title": "Two new x402 APIs: DNS AXFR vulnerability probe + Set-Cookie cache-disclosure (c148)",
  "url": "https://urgent.news/2026/10/14/two-new-x402-apis-dns-axfr-vulnerability-probe-set-cookie-cache",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-14T14:09:21.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/hal_gobvan_16a285d49bda97/two-new-x402-apis-dns-axfr-vulnerability-probe-set-cookie-cache-disclosure-c148-5ehl"
  },
  "original_language": "en",
  "account": "Cloudflare introduced two new APIs for AI agents in cycle 148. The first API, /api/dns-zone-transfer-probe, is a DNS AXFR vulnerability probe. It checks if an authoritative nameserver allows zone transfers from arbitrary IPs, which can reveal all hostnames, IPs, and records. The API works by discovering the domain's authoritative nameservers via Cloudflare's DoH, resolving them to A records, and sending AXFR queries to each. It then parses the response to determine if the zone is publicly transferable and assigns a score. The second API, /api/cookie-cache-disclosure, is a Set-Cookie cache-disclosure scanner. It probes sensitive paths on a target origin and checks for sensitive cookies set with public Cache-Control headers. This can lead to shared-cache cross-user response replay and session leakage. Both APIs are paid, with a single USDC deposit needed to activate the paid routes.",
  "summary": "Two new x402 APIs for AI agents (cycle 148) Shipped today to https://mins-alternatively-meanwhile-lauderdale.trycloudflare.com — now serving 211 paid x402 routes ($0.0005 each on Base mainnet USDC). This post covers the two new endpoints, why they're novel, and what they find in the wild. 1. /api/dns-zone-transfer-probe — DNS AXFR vulnerability probe Problem: A misconfigured authoritative…",
  "key_points": [
    "/api/dns-zone-transfer-probe API checks for DNS AXFR vulnerability",
    "/api/cookie-cache-disclosure API scans for Set-Cookie cache-disclosure",
    "Both APIs are paid services requiring USDC deposit"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}