CVE-2026-71193In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only.
Updated under an hour ago ()
Does this affect you?
It affects OpenStack Designate. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that conflicts with another tenant's zone. This enables cross-tenant DNS hijack (redirecting traffic to attacker-controlled IPs) and DNS denial of service (NODATA responses). Exploitation requires a multi-pool deployment with AttributeFilter enabled in scheduler_filters, which is a non-default but documented and supported configuration for self-service tiering.
- CVSS
- 9.6 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
- Weakness (CWE)
- CWE-863
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- mitre
- NVD analysis
- Awaiting Analysis
- Record last updated
- Aug 13, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
OpenStack Designate openstack:designate (from the name) | from 1.0.0 before 20.0.2; from 21.0.0 before 21.0.1; from 22.0.0 before 22.0.1 | CNA record |
References
- https://launchpad.net/bugs/2160533issue-tracking
- https://security.openstack.org/ossa/OSSA-2026-034.htmlvendor-advisory
- https://www.openwall.com/lists/oss-security/2026/08/11/6vendor-advisory, mailing-list
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.