CVE-2026-71193: Critical severity Openstack Designate vulnerability
In OpenStack Designate before 22.0.1, zone creation checks (issubzone, issuperzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that conflicts with another tenant's zone. This enables cross-tenant DNS hijack (redirecting traffic to attacker-controlled IPs) and DNS denial of service (NODATA responses). Exploitation requires a multi-pool deployment with AttributeFilter enabled in schedulerfilters, which is a non-default but documented and supported configuration for self-service tiering.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenStack Designateto a version that resolves this vulnerability.Fixed in 22.0.1 - Configuration
In the scheduler_filters configuration, disable AttributeFilter (it is required for exploitation in multi-pool deployments) to prevent overlapping cross-tenant zones via pool switching.
OpenStack Designate scheduler_filters/AttributeFilter = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71193?
CVE-2026-71193 has a severity rating of critical with a score of 9.6.
How do I fix CVE-2026-71193?
To fix CVE-2026-71193, upgrade OpenStack Designate to version 22.0.1 or later.
What vulnerabilities are exploited in CVE-2026-71193?
CVE-2026-71193 allows authenticated users to bypass zone creation checks, potentially leading to unauthorized zone configurations.
Who can be affected by CVE-2026-71193?
Authenticated users within OpenStack Designate can be affected by CVE-2026-71193 if they exploit the vulnerability.
What software is impacted by CVE-2026-71193?
CVE-2026-71193 impacts OpenStack Designate versions prior to 22.0.1.