CVE-2026-71193: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-71193 is an incorrect authorization vulnerability in OpenStack Designate that allows authenticated users to bypass zone overlap checks and create overlapping DNS zones across tenant boundaries. Reported by Tore Anderson of Redpill Linpro AS and disclosed on August 11, 2026 as part of OSSA-2026-034, it affects Designate versions >=1.0.0 <20.0.2, 21.0.0, and 22.0.0. The vulnerability carries a CVSS v3.1 base score of 9.6 (Critical) with a changed scope, reflecting its cross-tenant impact (GitHub Advisory, OSS-Security).

The root cause is CWE-863 (Incorrect Authorization): zone creation validation checks — _is_subzone, _is_superzone, and the duplicate-zone database constraint — are scoped only to the target pool, not globally across all pools. An authenticated user can exploit this by specifying a non-default pool via the AttributeFilter scheduler (configured in scheduler_filters), causing Designate to schedule the zone to a pool where the overlap checks are not performed against zones owned by other tenants. This allows creation of a zone that is a sub-zone, super-zone, or exact duplicate of another tenant's zone. Exploitation requires a multi-pool deployment with AttributeFilter enabled, which is a non-default but documented and supported configuration (OSS-Security, GitHub Advisory).

Successful exploitation enables two distinct attack scenarios: cross-tenant DNS hijacking, where an attacker redirects DNS traffic for another tenant's zone to attacker-controlled IP addresses, and DNS denial of service, where the presence of overlapping zones causes NODATA responses for legitimate DNS queries. The mDNS handler (addressed separately as CVE-2026-71194) performs pool-blind record lookups, causing deterministic denial of service when colliding zones exist across pools. All multi-pool Designate deployments are affected, with integrity and availability both rated High and scope changed to reflect cross-tenant impact (OSS-Security, GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.525%, placing it in the 42nd percentile for exploitation probability within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation is constrained to authenticated users in environments with multi-pool configurations and AttributeFilter enabled, limiting the attack surface to specific deployment configurations (OSS-Security).

1. Reconnaissance: Identify a target OpenStack deployment running Designate with multiple pools and AttributeFilter enabled in scheduler_filters. Confirm the deployment is running an affected version (>=1.0.0 <20.0.2, 21.0.0, or 22.0.0).
2. Authenticate: Obtain valid credentials for any tenant account with zone creation privileges on the Designate service.
3. Enumerate pools: Use the Designate API (GET /v2/pools) to list available pools and identify pool IDs other than the default pool.
4. Identify target zone: Determine the name of a zone owned by another tenant that you wish to hijack or disrupt (e.g., victim-domain.example.com).
5. Craft zone creation request: Submit a zone creation API request (POST /v2/zones) specifying the target zone name and using the AttributeFilter scheduler hint to direct the zone to a non-default pool where cross-pool overlap checks are not enforced.
6. Achieve DNS hijack or DoS: Once the overlapping zone is created, configure DNS records within it to redirect traffic to attacker-controlled IPs (hijack), or rely on the mDNS handler's pool-blind lookups to generate NODATA responses for the victim's zone (DoS) (OSS-Security, GitHub Advisory).

• Logs: Designate API logs showing zone creation requests (POST /v2/zones) from a tenant for a zone name that duplicates or overlaps with another tenant's existing zone; scheduler logs showing AttributeFilter directing zones to non-default pools.
• Database: Presence of duplicate or overlapping zone names across different pools in the Designate database; zones owned by different tenants sharing the same or hierarchically related names.
• DNS: Unexpected DNS responses (NODATA or incorrect IP addresses) for zones that should be authoritative; DNS queries returning attacker-controlled IPs for legitimate tenant domains.
• API Activity: Unusual zone creation activity from a single tenant account targeting multiple pool IDs, especially if the zone names mirror those of other tenants (OSS-Security).

Upgrade OpenStack Designate to version 20.0.2 (2025.1/epoxy), 21.0.1 (2025.2/flamingo), or 22.0.1 (2026.1/gazpacho) which contain the cross-pool zone ownership enforcement fix. Operators applying patches to older releases should ensure prerequisite backports (mDNS split-horizon pool scoping, Change 998005/998006) are present before applying the fix. As an interim workaround for deployments unable to patch immediately, restrict zone creation permissions to trusted users only or disable the AttributeFilter scheduler if self-service pool tiering is not required. Operators should also audit existing zones for cross-tenant collisions that may have been created prior to patching (OSS-Security, GitHub Advisory).

The vulnerability was covered by The Hacker Wire, which highlighted the DNS hijack risk in multi-pool OpenStack deployments (The Hacker Wire). The OpenStack Vulnerability Management Team issued the official advisory OSSA-2026-034, crediting Tore Anderson of Redpill Linpro AS for the discovery and Omer Schwartz of Red Hat for independently identifying the related mDNS DoS issue (OSS-Security). The Yaook operator project issued commits to address the vulnerability in their managed deployments (Yaook GitLab).