{"id":"CVE-2026-71193","aliases":["DEBIAN-CVE-2026-71193","EUVD-2026-57689","GHSA-8f9r-f5gr-x4fc","UBUNTU-CVE-2026-71193","USN-8860-1"],"status":"published","title":"In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the...","description":"In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that conflicts with another tenant's zone. This enables cross-tenant DNS hijack (redirecting traffic to attacker-controlled IPs) and DNS denial of service (NODATA responses). Exploitation requires a multi-pool deployment with AttributeFilter enabled in scheduler_filters, which is a non-default but documented and supported configuration for self-service tiering.","severity":{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00525,"percentile":0.44832,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2026-08-12T22:17:12Z","modified":"2026-10-28T02:31:00Z","fixes":[{"ecosystem":"Debian:12","package":"designate","fixed_in":["1:15.0.2-0+deb11u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"designate","fixed_in":["1:20.0.0-2+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"designate","fixed_in":["1:22.0.0-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"designate","fixed_in":["1:2.1.0-0ubuntu1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"designate","fixed_in":["1:6.0.1-0ubuntu1.2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"designate","fixed_in":["1:10.0.2-0ubuntu1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"designate","fixed_in":["1:14.0.4-0ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"designate","fixed_in":["1:18.0.0-0ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"designate","fixed_in":["1:22.0.0-0ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.0.2-0+deb11u1"}]}],"versions":["1:15.0.0-4"]},{"source":"osv","ecosystem":"Debian:13","package":"designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.0.0-2+deb13u1"}]}],"versions":["1:20.0.0-2"]},{"source":"osv","ecosystem":"Debian:14","package":"designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.0.0-2"}]}],"versions":["1:20.0.0-2","1:21.0.0-1","1:21.0.0-2","1:21.0.0~rc1-1","1:21.0.0~rc1-2","1:21.0.0~rc1-3","1:21.0.0~rc1-4","1:22.0.0-1","1:22.0.0~rc1-1","1:22.0.0~rc1-2","1:22.0.0~rc1-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.1.0-0ubuntu1+esm1"}]}],"versions":["1:1.0.0-0ubuntu1","1:2.0.0~b1-0ubuntu1","1:2.0.0~b2-0ubuntu1","1:2.0.0~b2-0ubuntu2","1:2.0.0~b3-0ubuntu1","1:2.0.0~b3-0ubuntu2","1:2.0.0~rc1-0ubuntu1","1:2.0.0-0ubuntu1","1:2.1.0-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.0.1-0ubuntu1.2+esm1"}]}],"versions":["1:5.0.0-0ubuntu1","1:6.0.0~b1-0ubuntu1","1:6.0.0~b1-0ubuntu2","1:6.0.0~b2-0ubuntu1","1:6.0.0~b3-0ubuntu1","1:6.0.0~rc1-0ubuntu1","1:6.0.0-0ubuntu1","1:6.0.1-0ubuntu1","1:6.0.1-0ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.0.2-0ubuntu1+esm1"}]}],"versions":["1:9.0.0-0ubuntu1","1:10.0.0~b1~git2019121610.cdac0fc2-0ubuntu1","1:10.0.0~b1~git2019121610.cdac0fc2-0ubuntu2","1:10.0.0~b2~git2020021416.8b5ec128-0ubuntu2","1:10.0.0~b3~git2020032414.dd359ba3-0ubuntu1","1:10.0.0~b3~git2020041012.9ed2623a-0ubuntu1","1:10.0.0-0ubuntu0.20.04.1","1:10.0.1-0ubuntu1","1:10.0.2-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.0.4-0ubuntu1.1"}]}],"versions":["1:13.0.0-0ubuntu1","1:13.0.0+git2021120810.aa798fc0-0ubuntu1","1:13.0.0+git2022011215.bff3d5f6-0ubuntu1","1:13.0.0+git2022030310.8ce022a7-0ubuntu1","1:14.0.0-0ubuntu1","1:14.0.1-0ubuntu1","1:14.0.2-0ubuntu1","1:14.0.3-0ubuntu1","1:14.0.4-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.0.0-0ubuntu1.1"}]}],"versions":["1:17.0.0-0ubuntu2","1:17.0.1+git2023121308.d90691f3-0ubuntu1","1:17.0.1+git2024011916.002005a4-0ubuntu2","1:18.0.0~rc1-0ubuntu1","1:18.0.0-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.0.0-0ubuntu2.1"}]}],"versions":["1:21.0.0-0ubuntu1","1:21.0.0-0ubuntu2","1:21.0.0+git20260121.19.145042f4-0ubuntu1","1:22.0.0~rc1-0ubuntu1","1:22.0.0-0ubuntu1","1:22.0.0-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.1.0-0ubuntu1+esm1"}]}],"versions":["1:1.0.0-0ubuntu1","1:2.0.0~b1-0ubuntu1","1:2.0.0~b2-0ubuntu1","1:2.0.0~b2-0ubuntu2","1:2.0.0~b3-0ubuntu1","1:2.0.0~b3-0ubuntu2","1:2.0.0~rc1-0ubuntu1","1:2.0.0-0ubuntu1","1:2.1.0-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.0.1-0ubuntu1.2+esm1"}]}],"versions":["1:5.0.0-0ubuntu1","1:6.0.0~b1-0ubuntu1","1:6.0.0~b1-0ubuntu2","1:6.0.0~b2-0ubuntu1","1:6.0.0~b3-0ubuntu1","1:6.0.0~rc1-0ubuntu1","1:6.0.0-0ubuntu1","1:6.0.1-0ubuntu1","1:6.0.1-0ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.0.2-0ubuntu1+esm1"}]}],"versions":["1:9.0.0-0ubuntu1","1:10.0.0~b1~git2019121610.cdac0fc2-0ubuntu1","1:10.0.0~b1~git2019121610.cdac0fc2-0ubuntu2","1:10.0.0~b2~git2020021416.8b5ec128-0ubuntu2","1:10.0.0~b3~git2020032414.dd359ba3-0ubuntu1","1:10.0.0~b3~git2020041012.9ed2623a-0ubuntu1","1:10.0.0-0ubuntu0.20.04.1","1:10.0.1-0ubuntu1","1:10.0.2-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.0.4-0ubuntu1.1"}]}],"versions":["1:13.0.0-0ubuntu1","1:13.0.0+git2021120810.aa798fc0-0ubuntu1","1:13.0.0+git2022011215.bff3d5f6-0ubuntu1","1:13.0.0+git2022030310.8ce022a7-0ubuntu1","1:14.0.0-0ubuntu1","1:14.0.1-0ubuntu1","1:14.0.2-0ubuntu1","1:14.0.3-0ubuntu1","1:14.0.4-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.0.0-0ubuntu1.1"}]}],"versions":["1:17.0.0-0ubuntu2","1:17.0.1+git2023121308.d90691f3-0ubuntu1","1:17.0.1+git2024011916.002005a4-0ubuntu2","1:18.0.0~rc1-0ubuntu1","1:18.0.0-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.0.0-0ubuntu2.1"}]}],"versions":["1:21.0.0-0ubuntu1","1:21.0.0-0ubuntu2","1:21.0.0+git20260121.19.145042f4-0ubuntu1","1:22.0.0~rc1-0ubuntu1","1:22.0.0-0ubuntu1","1:22.0.0-0ubuntu2"]}],"products":[{"vendor":"openstack","product":"designate"},{"vendor":"red hat","product":"designate"}],"references":[{"url":"https://launchpad.net/bugs/2160533","tags":["issue-tracking","report"]},{"url":"https://security.openstack.org/ossa/OSSA-2026-034.html","tags":["vendor-advisory","advisory","report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/08/11/6","tags":["vendor-advisory","mailing-list","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71193","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8f9r-f5gr-x4fc"},{"url":"https://opendev.org/openstack/designate","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71193.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-71193","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-71193","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71193","tags":["report"]},{"url":"https://bugs.launchpad.net/designate/+bug/2160533","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8860-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-71193","description":"In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that conflicts with another tenant's zone. This enables cross-tenant DNS hijack (redirecting traffic to attacker-controlled IPs) and DNS denial of service (NODATA responses). Exploitation requires a multi-pool deployment with AttributeFilter enabled in scheduler_filters, which is a non-default but documented and supported configuration for self-service tiering.","status":"published","published":"2026-08-12T22:17:12.516Z","modified":"2026-08-13T13:35:19.251Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:19:49.559463Z"}],"euvd":[{"id":"EUVD-2026-57689","description":"In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that conflicts with another tenant's zone. This enables cross-tenant DNS hijack (redirecting traffic to attacker-controlled IPs) and DNS denial of service (NODATA responses). Exploitation requires a multi-pool deployment with AttributeFilter enabled in scheduler_filters, which is a non-default but documented and supported configuration for self-service tiering.","status":"published","published":"2026-08-12T22:17:12Z","modified":"2026-08-13T13:35:19Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:01:56.761721Z"}],"ghsa":[{"id":"GHSA-8f9r-f5gr-x4fc","title":"In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the...","description":"In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that conflicts with another tenant's zone. This enables cross-tenant DNS hijack (redirecting traffic to attacker-controlled IPs) and DNS denial of service (NODATA responses). Exploitation requires a multi-pool deployment with AttributeFilter enabled in scheduler_filters, which is a non-default but documented and supported configuration for self-service tiering.","status":"published","published":"2026-08-13T00:31:28Z","modified":"2026-08-13T00:31:36Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H","level":"critical"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:10:24.70819Z"}],"nvd":[{"id":"CVE-2026-71193","description":"In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that conflicts with another tenant's zone. This enables cross-tenant DNS hijack (redirecting traffic to attacker-controlled IPs) and DNS denial of service (NODATA responses). Exploitation requires a multi-pool deployment with AttributeFilter enabled in scheduler_filters, which is a non-default but documented and supported configuration for self-service tiering.","status":"published","published":"2026-08-12T23:17:22.03Z","modified":"2026-10-24T15:10:00.19Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:12:37.217486Z"}],"osv":[{"id":"CVE-2026-71193","description":"In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that conflicts with another tenant's zone. This enables cross-tenant DNS hijack (redirecting traffic to attacker-controlled IPs) and DNS denial of service (NODATA responses). Exploitation requires a multi-pool deployment with AttributeFilter enabled in scheduler_filters, which is a non-default but documented and supported configuration for self-service tiering.","status":"published","published":"2026-08-12T22:17:12.516Z","modified":"2026-10-28T02:31:00.076032718Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H","level":"critical"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:45:15.164658Z"},{"id":"DEBIAN-CVE-2026-71193","description":"In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that conflicts with another tenant's zone. This enables cross-tenant DNS hijack (redirecting traffic to attacker-controlled IPs) and DNS denial of service (NODATA responses). Exploitation requires a multi-pool deployment with AttributeFilter enabled in scheduler_filters, which is a non-default but documented and supported configuration for self-service tiering.","status":"published","published":"2026-08-12T23:17:22.03Z","modified":"2026-10-25T09:47:29.174543282Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:46:02.094661Z"},{"id":"UBUNTU-CVE-2026-71193","description":"In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that conflicts with another tenant's zone. This enables cross-tenant DNS hijack (redirecting traffic to attacker-controlled IPs) and DNS denial of service (NODATA responses). Exploitation requires a multi-pool deployment with AttributeFilter enabled in scheduler_filters, which is a non-default but documented and supported configuration for self-service tiering.","status":"published","published":"2026-08-12T23:17:00Z","modified":"2026-10-01T19:10:18.781024932Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:57:03.035847Z"},{"id":"USN-8860-1","title":"designate vulnerability","description":"It was discovered that OpenStack Designate did not properly validate\noverlapping zones under certain circumstances. An authenticated user could\npossibly use this issue to redirect DNS traffic to attacker-controlled\nsystems or cause a denial of service.","status":"published","published":"2026-10-01T11:17:31Z","modified":"2026-10-01T19:13:08.024977849Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}