CVE-2026-71193

Name of the Vulnerable Software and Affected Versions OpenStack Designate versions prior to 22.0.1

Description An authenticated user can bypass zone creation checks by scheduling a zone to a different pool using the AttributeFilter scheduler. This occurs because the is subzone and is superzone functions, as well as the duplicate-zone database constraint, are only scoped to the target pool. This flaw allows the creation of overlapping zones that conflict with zones belonging to other tenants, potentially leading to cross-tenant DNS hijacking, where traffic is redirected to attacker-controlled IP addresses, or DNS denial of service resulting in NODATA responses. This issue affects multi-pool deployments where AttributeFilter is enabled in scheduler filters for self-service tiering.

Recommendations Update to version 22.0.1 or later. As a temporary mitigation, disable the AttributeFilter in scheduler filters to prevent the bypass of zone creation checks.