{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71193", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-08-05T05:09:31.046Z", "datePublished": "2026-08-12T22:17:12.516Z", "dateUpdated": "2026-08-13T13:35:19.251Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Designate", "repo": "https://opendev.org/openstack/designate", "vendor": "OpenStack", "versions": [{"lessThan": "20.0.2", "status": "affected", "version": "1.0.0", "versionType": "semver"}, {"lessThan": "21.0.1", "status": "affected", "version": "21.0.0", "versionType": "semver"}, {"lessThan": "22.0.1", "status": "affected", "version": "22.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that conflicts with another tenant's zone. This enables cross-tenant DNS hijack (redirecting traffic to attacker-controlled IPs) and DNS denial of service (NODATA responses). Exploitation requires a multi-pool deployment with AttributeFilter enabled in scheduler_filters, which is a non-default but documented and supported configuration for self-service tiering."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-08-12T22:17:12.516Z"}, "references": [{"tags": ["issue-tracking"], "url": "https://launchpad.net/bugs/2160533"}, {"tags": ["vendor-advisory"], "url": "https://security.openstack.org/ossa/OSSA-2026-034.html"}, {"tags": ["vendor-advisory", "mailing-list"], "url": "https://www.openwall.com/lists/oss-security/2026/08/11/6"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:openstack:designate:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0.0", "versionEndExcluding": "20.0.2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:openstack:designate:*:*:*:*:*:*:*:*", "versionStartIncluding": "21.0.0", "versionEndExcluding": "21.0.1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:openstack:designate:*:*:*:*:*:*:*:*", "versionStartIncluding": "22.0.0", "versionEndExcluding": "22.0.1"}]}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-13T13:33:33.269958Z", "id": "CVE-2026-71193", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T13:35:19.251Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-71193", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T13:33:33.269958Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T13:35:10.650Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://opendev.org/openstack/designate", "vendor": "OpenStack", "product": "Designate", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "20.0.2", "versionType": "semver"}, {"status": "affected", "version": "21.0.0", "lessThan": "21.0.1", "versionType": "semver"}, {"status": "affected", "version": "22.0.0", "lessThan": "22.0.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://launchpad.net/bugs/2160533", "tags": ["issue-tracking"]}, {"url": "https://security.openstack.org/ossa/OSSA-2026-034.html", "tags": ["vendor-advisory"]}, {"url": "https://www.openwall.com/lists/oss-security/2026/08/11/6", "tags": ["vendor-advisory", "mailing-list"]}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that conflicts with another tenant's zone. This enables cross-tenant DNS hijack (redirecting traffic to attacker-controlled IPs) and DNS denial of service (NODATA responses). Exploitation requires a multi-pool deployment with AttributeFilter enabled in scheduler_filters, which is a non-default but documented and supported configuration for self-service tiering."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openstack:designate:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "20.0.2", "versionStartIncluding": "1.0.0"}, {"criteria": "cpe:2.3:a:openstack:designate:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "21.0.1", "versionStartIncluding": "21.0.0"}, {"criteria": "cpe:2.3:a:openstack:designate:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "22.0.1", "versionStartIncluding": "22.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-08-12T22:17:12.516Z"}}}, "cveMetadata": {"cveId": "CVE-2026-71193", "state": "PUBLISHED", "dateUpdated": "2026-08-13T13:35:19.251Z", "dateReserved": "2026-08-05T05:09:31.046Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-08-12T22:17:12.516Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Designate", "repo": "https://opendev.org/openstack/designate", "vendor": "OpenStack", "versions": [{"lessThan": "20.0.2", "status": "affected", "version": "1.0.0", "versionType": "semver"}, {"lessThan": "21.0.1", "status": "affected", "version": "21.0.0", "versionType": "semver"}, {"lessThan": "22.0.1", "status": "affected", "version": "22.0.0", "versionType": "semver"}]}], "source": "[email protected]"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that conflicts with another tenant's zone. This enables cross-tenant DNS hijack (redirecting traffic to attacker-controlled IPs) and DNS denial of service (NODATA responses). Exploitation requires a multi-pool deployment with AttributeFilter enabled in scheduler_filters, which is a non-default but documented and supported configuration for self-service tiering."}], "id": "CVE-2026-71193", "lastModified": "2026-08-13T14:17:12.087", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 5.8, "source": "[email protected]", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71193", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-13T13:33:33.269958Z", "version": "2.0.3"}}]}, "published": "2026-08-12T23:17:22.030", "references": [{"source": "[email protected]", "url": "https://launchpad.net/bugs/2160533"}, {"source": "[email protected]", "url": "https://security.openstack.org/ossa/OSSA-2026-034.html"}, {"source": "[email protected]", "url": "https://www.openwall.com/lists/oss-security/2026/08/11/6"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "[email protected]", "type": "Secondary"}]}

{"acknowledgement": "Upstream acknowledges Omer Schwartz (Red Hat) and Tore Anderson (Redpill Linpro AS) as the original reporters.", "bugzilla": {"description": "openstack-designate: designate: cross-tenant DNS zone overlap via pool-scoped ownership checks when using AttributeFilter scheduler", "id": "2510947", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510947"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-863", "details": ["A flaw was found in OpenStack Designate. When the AttributeFilter scheduler is enabled with multiple DNS pools, an authenticated tenant can bypass zone ownership checks by scheduling a zone to a different pool. The database uniqueness constraint on zone names is pool-scoped, and the subzone/superzone ownership checks in the Central service include pool_id in their query criteria, making them pool-scoped rather than global. This allows a tenant to create zones that overlap with another tenant's zones in a different pool, bypassing cross-tenant namespace isolation. Successful exploitation could lead to cross-tenant DNS zone overlap and subzone ownership bypass."], "mitigation": {"lang": "en:us", "value": "For deployments not using multi-pool DNS: verify that the 'scheduler_filters' configuration option in the [service:central] section only contains 'default_pool' (the default value). This prevents tenants from selecting alternative pools and eliminates the zone overlap vulnerability.\nFor deployments using multi-pool DNS: replace the 'attribute' filter with 'pool_id_attribute' in the 'scheduler_filters' configuration. The pool_id_attribute filter enforces the 'zone_create_forced_pool' policy check, which defaults to requiring the SYSTEM_ADMIN role, preventing regular tenants from choosing pools."}, "name": "CVE-2026-71193", "package_state": [{"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Fix deferred", "package_name": "openstack-designate", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Fix deferred", "package_name": "openstack-designate", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Fix deferred", "package_name": "openstack-designate", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Fix deferred", "package_name": "openstack-designate", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2026-08-11T15:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-71193\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-71193\nhttps://launchpad.net/bugs/2160533"], "statement": "Red Hat OpenStack Platform (RHOSP) ships Designate across multiple versions. Multipool deployments using the AttributeFilter scheduler were never a fully supported configuration in any RHOSP version. In RHOSP 13, 16.2, and 17.1 (TripleO deployment), the default scheduler_filters configuration is default_pool, which assigns all zones to a single pool and prevents the cross-tenant zone overlap.\nFor Red Hat OpenStack Services on OpenShift (RHOSO, openstack-18.0), the designate-operator hardcodes scheduler_filters to pool_id_attribute, in_doubt_default_pool in the central service configuration template. The pool_id_attribute filter enforces the zone_create_forced_pool policy check, which defaults to requiring the SYSTEM_ADMIN role, preventing regular tenants from selecting pools. Therefore, RHOSO is not affected in the default configuration. However, RHOSO becomes affected if an administrator uses the customServiceConfig field to set scheduler_filters to include the attribute filter, as customServiceConfig is a freeform string with no CRD validation or webhook filtering, written to a config-dir override that oslo.config loads with last-wins semantics, silently overriding the operator's safe default.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.0.0,20.0.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[21.0.0,21.0.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[22.0.0,22.0.1)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Designate", "source": "cna", "vendor": "OpenStack"}, "product": "designate", "vendor": "openstack"}], "created": "2026-08-12T23:15:03.357302+00:00", "title": "Cross\u2011Tenant DNS Hijack and Denial of Service via Designate Zone Creation", "updated": "2026-08-13T02:15:02.663757+00:00", "vendors": ["openstack", "openstack$PRODUCT$designate"]}