CVE-2026-71194
In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving...
In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools, the lookup fails with a deterministic error, causing the handler to return REFUSED for all DNS queries through that path. The _handle_notify path is exploitable via a single unauthenticated UDP packet. This is independently reachable through the cross-tenant zone overlap described in a different recent CVE, and also affects legitimate same-tenant cross-pool configurations. BIND9 views do not mitigate this issue as mDNS is a shared service upstream of any view configuration.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools, the lookup fails with a deterministic error, causing the handler to return REFUSED for all DNS queries through that path. The _handle_notify path is exploitable via a single unauthenticated UDP packet. This is independently reachable through the cross-tenant zone overlap described in a different recent CVE, and also affects legitimate same-tenant cross-pool configurations. BIND9 views do not mitigate this issue as mDNS is a shared service upstream of any view configuration.
- Record
CVE-2026-71194- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H - Weakness
- CWE-669
- Updated
- 2026-11-02
EUVDEUVD-2026-57692
In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools, the lookup fails with a deterministic error, causing the handler to return REFUSED for all DNS queries through that path. The _handle_notify path is exploitable via a single unauthenticated UDP packet. This is independently reachable through the cross-tenant zone overlap described in a different recent CVE, and also affects legitimate same-tenant cross-pool configurations. BIND9 views do not mitigate this issue as mDNS is a shared service upstream of any view configuration.
- Record
EUVD-2026-57692- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-r7xh-5qq7-jh72
In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving...
In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools, the lookup fails with a deterministic error, causing the handler to return REFUSED for all DNS queries through that path. The _handle_notify path is exploitable via a single unauthenticated UDP packet. This is independently reachable through the cross-tenant zone overlap described in a different recent CVE, and also affects legitimate same-tenant cross-pool configurations. BIND9 views do not mitigate this issue as mDNS is a shared service upstream of any view configuration.
- Record
GHSA-r7xh-5qq7-jh72- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H - Weakness
- CWE-669
- Updated
- 2026-11-02
NVD
In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools, the lookup fails with a deterministic error, causing the handler to return REFUSED for all DNS queries through that path. The _handle_notify path is exploitable via a single unauthenticated UDP packet. This is independently reachable through the cross-tenant zone overlap described in a different recent CVE, and also affects legitimate same-tenant cross-pool configurations. BIND9 views do not mitigate this issue as mDNS is a shared service upstream of any view configuration.
- Record
CVE-2026-71194- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H - Weakness
- CWE-669
- Updated
- 2026-11-02
OSV
In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools, the lookup fails with a deterministic error, causing the handler to return REFUSED for all DNS queries through that path. The _handle_notify path is exploitable via a single unauthenticated UDP packet. This is independently reachable through the cross-tenant zone overlap described in a different recent CVE, and also affects legitimate same-tenant cross-pool configurations. BIND9 views do not mitigate this issue as mDNS is a shared service upstream of any view configuration.
- Record
CVE-2026-71194- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H - Weakness
- CWE-669
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-71194
In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools, the lookup fails with a deterministic error, causing the handler to return REFUSED for all DNS queries through that path. The _handle_notify path is exploitable via a single unauthenticated UDP packet. This is independently reachable through the cross-tenant zone overlap described in a different recent CVE, and also affects legitimate same-tenant cross-pool configurations. BIND9 views do not mitigate this issue as mDNS is a shared service upstream of any view configuration.
- Record
DEBIAN-CVE-2026-71194- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-71194
In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools, the lookup fails with a deterministic error, causing the handler to return REFUSED for all DNS queries through that path. The _handle_notify path is exploitable via a single unauthenticated UDP packet. This is independently reachable through the cross-tenant zone overlap described in a different recent CVE, and also affects legitimate same-tenant cross-pool configurations. BIND9 views do not mitigate this issue as mDNS is a shared service upstream of any view configuration.
- Record
UBUNTU-CVE-2026-71194- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
designateDebian:12 |
before 1:15.0.2-0+deb11u1, plus listed versions 1:15.0.0-4 |
1:15.0.2-0+deb11u1 |
designateDebian:13 |
before 1:20.0.0-2+deb13u1, plus listed versions 1:20.0.0-2 |
1:20.0.0-2+deb13u1 |
designateDebian:14 |
before 1:22.0.0-2, plus listed versions 1:20.0.0-21:21.0.0-11:21.0.0-21:21.0.0~rc1-11:21.0.0~rc1-2 Show 6 moreShow less1:21.0.0~rc1-31:21.0.0~rc1-41:22.0.0-11:22.0.0~rc1-11:22.0.0~rc1-21:22.0.0~rc1-3 |
1:22.0.0-2 |
designateUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1:1.0.0-0ubuntu11:2.0.0~b1-0ubuntu11:2.0.0~b2-0ubuntu11:2.0.0~b2-0ubuntu21:2.0.0~b3-0ubuntu1 Show 5 moreShow less1:2.0.0~b3-0ubuntu21:2.0.0~rc1-0ubuntu11:2.0.0-0ubuntu11:2.1.0-0ubuntu11:2.1.0-0ubuntu1+esm1 |
None known |
designateUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1:5.0.0-0ubuntu11:6.0.0~b1-0ubuntu11:6.0.0~b1-0ubuntu21:6.0.0~b2-0ubuntu11:6.0.0~b3-0ubuntu1 Show 5 moreShow less1:6.0.0~rc1-0ubuntu11:6.0.0-0ubuntu11:6.0.1-0ubuntu11:6.0.1-0ubuntu1.21:6.0.1-0ubuntu1.2+esm1 |
None known |
designateUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1:9.0.0-0ubuntu11:10.0.0~b1~git2019121610.cdac0fc2-0ubuntu11:10.0.0~b1~git2019121610.cdac0fc2-0ubuntu21:10.0.0~b2~git2020021416.8b5ec128-0ubuntu21:10.0.0~b3~git2020032414.dd359ba3-0ubuntu1 Show 5 moreShow less1:10.0.0~b3~git2020041012.9ed2623a-0ubuntu11:10.0.0-0ubuntu0.20.04.11:10.0.1-0ubuntu11:10.0.2-0ubuntu11:10.0.2-0ubuntu1+esm1 |
None known |
designateUbuntu:22.04:LTS |
All versions, plus listed versions 1:13.0.0-0ubuntu11:13.0.0+git2021120810.aa798fc0-0ubuntu11:13.0.0+git2022011215.bff3d5f6-0ubuntu11:13.0.0+git2022030310.8ce022a7-0ubuntu11:14.0.0-0ubuntu1 Show 5 moreShow less1:14.0.1-0ubuntu11:14.0.2-0ubuntu11:14.0.3-0ubuntu11:14.0.4-0ubuntu11:14.0.4-0ubuntu1.1 |
None known |
designateUbuntu:24.04:LTS |
All versions, plus listed versions 1:17.0.0-0ubuntu21:17.0.1+git2023121308.d90691f3-0ubuntu11:17.0.1+git2024011916.002005a4-0ubuntu21:18.0.0~rc1-0ubuntu11:18.0.0-0ubuntu11:18.0.0-0ubuntu1.1 |
None known |
designateUbuntu:26.10 |
All versions, plus listed versions 1:22.0.0-0ubuntu21:22.0.0+git20260814.66.9f82089-0ubuntu11:23.0.0~rc1-0ubuntu21:23.0.0-0ubuntu1 |
None known |
designateUbuntu:26.04:LTS |
All versions, plus listed versions 1:21.0.0-0ubuntu11:21.0.0-0ubuntu21:21.0.0+git20260121.19.145042f4-0ubuntu11:22.0.0~rc1-0ubuntu11:22.0.0-0ubuntu11:22.0.0-0ubuntu21:22.0.0-0ubuntu2.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-71194 is a medium vulnerability (CVSS 6.8) in Openstack Designate, published August 12, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.52%, the 44th percentile. Fixed in designate 1:15.0.2-0+deb11u1.