CVE-2026-71193 OpenStack CVE debrief

Who should care

OpenStack Designate administrators and users, particularly those with multi-pool deployments and AttributeFilter enabled in scheduler_filters, should assess exposure and prioritize remediation. This includes operators managing OpenStack Designate, platform administrators, vulnerability management teams, and security teams responsible for ensuring the security and integrity of DNS services.

Why it matters

CVE-2026-71193 is a critical vulnerability in OpenStack Designate that allows an authenticated user to bypass zone creation checks and create overlapping zones, potentially leading to cross-tenant DNS hijack and DNS denial of service. OpenStack Designate administrators and users, particularly those with multi-pool deployments and AttributeFilter enabled in scheduler_filters, should assess exposure and prioritize remediation.

• Cross-tenant DNS hijack, allowing an attacker to redirect traffic to controlled IPs
• DNS denial of service, causing NODATA responses

Technical summary

The vulnerability exists in OpenStack Designate before version 22.0.1. An authenticated user can exploit this vulnerability by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that conflicts with another tenant's zone. This enables cross-tenant DNS hijack (redirecting traffic to attacker-controlled IPs) and DNS denial of service (NODATA responses).

Defensive priority

High

Recommended defensive actions

• Review and update OpenStack Designate to version 22.0.1 or later
• Restrict access to the AttributeFilter scheduler
• Monitor DNS traffic for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability exists in OpenStack Designate before version 22.0.1. An authenticated user can exploit this vulnerability by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that conflicts with another tenant's zone.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.