CVE-2026-71193
published 2026-08-12CVE-2026-71193: In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool…
PriorityP356critical9.6CVSS 3.1
AVNACLPRLUINSCCNIHAH
EPSS
0.53%
42.1th percentile
In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that conflicts with another tenant's zone. This enables cross-tenant DNS hijack (redirecting traffic to attacker-controlled IPs) and DNS denial of service (NODATA responses). Exploitation requires a multi-pool deployment with AttributeFilter enabled in scheduler_filters, which is a non-default but documented and supported configuration for self-service tiering.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openstack | designate | >= 1.0.0 < 20.0.2 | 20.0.2 |
| openstack | designate | >= 21.0.0 < 21.0.1 | 21.0.1 |
| openstack | designate | >= 22.0.0 < 22.0.1 | 22.0.1 |
CVSS provenance
nvdv3.19.6CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
vendor_redhat9.6CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
openstack-designate: designate: cross-tenant DNS zone overlap via pool-scoped ownership checks when using AttributeFilter scheduler
vendor_redhat·2026-08-11·CVSS 9.6
CVE-2026-71193 [CRITICAL] CWE-863 openstack-designate: designate: cross-tenant DNS zone overlap via pool-scoped ownership checks when using AttributeFilter scheduler
openstack-designate: designate: cross-tenant DNS zone overlap via pool-scoped ownership checks when using AttributeFilter scheduler
A flaw was found in OpenStack Designate. When the AttributeFilter scheduler is enabled with multiple DNS pools, an authenticated tenant can bypass zone ownership checks by scheduling a zone to a different pool. The database uniqueness constraint on zone names is pool-scoped, and the subzone/superzone ownership checks in the Central service include pool_id in their query criteria, making them pool-scoped rather than global. This allows a tenant to create zones that overlap with another tenant's zones in a different pool, bypassing cross-tenant namespace isolation. Successful exploitation could lead to cross-tenant DNS zone overlap and subzone ownership bypass.
Red Hat
openstack-designate: designate: mDNS NOTIFY handler DoS via pool-blind zone lookup
vendor_redhat·2026-08-11·CVSS 9.6
CVE-2026-71194 [CRITICAL] CWE-863 openstack-designate: designate: mDNS NOTIFY handler DoS via pool-blind zone lookup
openstack-designate: designate: mDNS NOTIFY handler DoS via pool-blind zone lookup
A flaw was found in the OpenStack Designate mDNS NOTIFY handler. The _handle_notify method performs zone lookups without pool_id scoping, unlike the QUERY and AXFR handlers which were previously updated to be pool-aware. When zones with the same name exist across different DNS pools, the storage layer finds multiple matches and raises a NotFound exception, causing all NOTIFY processing for the affected zone name to fail. This results in denial of service for DNS zone transfer notifications, causing stale zone data on secondary DNS servers. The mDNS NOTIFY path is reachable via unauthenticated UDP on port 5354.
Statement: Red Hat OpenStack Platform (RHOSP) ships Designate across multiple versions. The mDNS
GHSA
In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only.
ghsa_unreviewed·2026-08-13
CVE-2026-71193 [CRITICAL] CWE-863 In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only.
In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that conflicts with another tenant's zone. This enables cross-tenant DNS hijack (redirecting traffic to attacker-controlled IPs) and DNS denial of service (NODATA responses). Exploitation requires a multi-pool deployment with AttributeFilter enabled in scheduler_filters, which is a non-default but documented and supported configuration for self-service tiering.
VulDB
OpenStack Designate up to 20.0.1/21.0.0/22.0.0 Scheduler _is_subzone/_is_superzone privileges management (EUVD-2026-57689)
vuldb·2026-08-13·CVSS 9.6
CVE-2026-71193 [CRITICAL] OpenStack Designate up to 20.0.1/21.0.0/22.0.0 Scheduler _is_subzone/_is_superzone privileges management (EUVD-2026-57689)
A vulnerability classified as problematic has been found in OpenStack Designate up to 20.0.1/21.0.0/22.0.0. Affected is the function _is_subzone/_is_superzone of the component Scheduler. This manipulation causes improper privilege management.
This vulnerability is handled as CVE-2026-71193. The attack can be initiated remotely. There is not any exploit available.
It is recommended to upgrade the affected component.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-71194 openstack-designate: designate: mDNS NOTIFY handler DoS via pool-blind zone lookup
bugzilla·2026-08-06·CVSS 9.6
CVE-2026-71194 [CRITICAL] CVE-2026-71194 openstack-designate: designate: mDNS NOTIFY handler DoS via pool-blind zone lookup
CVE-2026-71194 openstack-designate: designate: mDNS NOTIFY handler DoS via pool-blind zone lookup
Omer Schwartz (Red Hat) discovered a vulnerability in the OpenStack Designate mDNS NOTIFY handler. The _handle_notify() method in designate/mdns/handler.py (lines 90-171) performs a zone lookup using only {name, type='SECONDARY', deleted=False} without pool_id scoping. When zones with the same name exist across different pools, the storage layer's _find() method (designate/storage/sqlalchemy/base.py:270-280) finds 2 results and raises ZoneNotFound (it expects exactly 1 with one=True), causing all NOTIFY processing for the affected zone name to fail with NOTAUTH. This NOTIFY handler path is reachable via unauthenticated UDP on port 5354 (default: 0.0.0.0:5354) because the SerializationMiddlewa
Bugzilla
CVE-2026-71193 openstack-designate: designate: cross-tenant DNS zone overlap via pool-scoped ownership checks when using AttributeFilter scheduler
bugzilla·2026-08-04·CVSS 9.6
CVE-2026-71193 [CRITICAL] CVE-2026-71193 openstack-designate: designate: cross-tenant DNS zone overlap via pool-scoped ownership checks when using AttributeFilter scheduler
CVE-2026-71193 openstack-designate: designate: cross-tenant DNS zone overlap via pool-scoped ownership checks when using AttributeFilter scheduler
Tore Anderson (Redpill Linpro AS) reported a vulnerability in OpenStack Designate zone scheduling. The database uniqueness constraint on zone names is scoped to (name, deleted, pool_id) in designate/storage/sqlalchemy/tables.py:146, allowing the same zone name to exist in multiple pools. The _is_subzone() and _is_superzone() ownership checks in designate/central/service.py (lines 288-328) include pool_id in their query criteria, making them pool-scoped rather than global. When the AttributeFilter scheduler (designate/scheduler/filters/attribute_filter.py) is enabled, any authenticated tenant with the default create_zone policy (role:member) can
2026-08-12
Published