CVE-2026-71193

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-71193
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71193.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-71193
Downstream
Published
2026-08-12T22:17:12.516Z
Modified
2026-08-14T04:04:08.373866479Z
Severity
  • 9.6 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H CVSS Calculator
Summary
[none]
Details

In OpenStack Designate before 22.0.1, zone creation checks (issubzone, issuperzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that conflicts with another tenant's zone. This enables cross-tenant DNS hijack (redirecting traffic to attacker-controlled IPs) and DNS denial of service (NODATA responses). Exploitation requires a multi-pool deployment with AttributeFilter enabled in scheduler_filters, which is a non-default but documented and supported configuration for self-service tiering.

Database specific 
{
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71193.json",
    "cna_assigner": "mitre"
}
References

Affected packages

Git / opendev.org/openstack/designate

Affected ranges

Type
GIT
Repo
https://opendev.org/openstack/designate
Events
Introduced
bfe79196c9557559f351ae9a854c73ac757051ee
Fixed
b5255cf54363bdb0775b51cc0fbf38eeb28aecae
Introduced
035453ffd1ba0f574a1d7f23b458222c0fd8fc68
Fixed
2ee5e4a00bc632283a4b5c5da1a94d8f184d1272
Introduced
ee2add08760a436d0173535699a6016ef18e03ae
Fixed
d4b703bb4637e6e740e4b401eac6e9308769c39f
Database specific
Show details 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "1.0.0"
        },
        {
            "fixed": "20.0.2"
        },
        {
            "introduced": "21.0.0"
        },
        {
            "fixed": "21.0.1"
        },
        {
            "introduced": "22.0.0"
        },
        {
            "fixed": "22.0.1"
        }
    ]
}

Affected versions

21.*
21.0.0
21.0.0.0rc1
22.*
22.0.0
22.0.0.0rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71193.json"