CVE-2026-71193
Fixed in a distro release EPSS <1%CVSS 9.6
In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that conflicts with another tenant's zone. This enables cross-tenant DNS hijack (redirecting traffic to attacker-controlled IPs) and DNS denial of service (NODATA responses). Exploitation requires a multi-pool deployment with AttributeFilter enabled in scheduler_filters, which is a non-default but documented and supported configuration for self-service tiering.
Products: openstack designate
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | designate | 1:15.0.2-0+deb11u1 |
| Debian 13 | designate | 1:20.0.0-2+deb13u1 |
| Debian 14 | designate | 1:22.0.0-2 |
| Ubuntu 22.04 LTS | designate | 1:14.0.4-0ubuntu1.1 |
| Ubuntu 24.04 LTS | designate | 1:18.0.0-0ubuntu1.1 |
| Ubuntu 26.04 LTS | designate | 1:22.0.0-0ubuntu2.1 |
| Ubuntu Pro 16.04 LTS | designate | 1:2.1.0-0ubuntu1+esm1 |
| Ubuntu Pro 18.04 LTS | designate | 1:6.0.1-0ubuntu1.2+esm1 |
| Ubuntu Pro 20.04 LTS | designate | 1:10.0.2-0ubuntu1+esm1 |