CVE-2026-71193
Description
In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that conflicts with another tenant's zone. This enables cross-tenant DNS hijack (redirecting traffic to attacker-controlled IPs) and DNS denial of service (NODATA responses). Exploitation requires a multi-pool deployment with AttributeFilter enabled in scheduler_filters, which is a non-default but documented and supported configuration for self-service tiering.
How to fix
- OpenStack Designate20.0.2, 21.0.1, 22.0.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| OpenStack Designate | 1.0.0 ≤ v < 20.0.2, 21.0.0 ≤ v < 21.0.1, 22.0.0 ≤ v < 22.0.1 | 20.0.2, 21.0.1, 22.0.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.