CVE-2026-71193: OpenStack Designate Auth Bypass Flaw

CVE-2026-71193 Overview

CVE-2026-71193 is an authorization flaw in OpenStack Designate versions before 22.0.1. The vulnerability exists in zone creation logic where the _is_subzone, _is_superzone, and duplicate-zone database constraints are scoped only to the target pool. An authenticated tenant can schedule a zone to a different pool using the AttributeFilter scheduler, bypassing overlap checks and creating a zone that conflicts with another tenant's existing zone. This enables cross-tenant Domain Name System (DNS) hijack by redirecting traffic to attacker-controlled IP addresses, as well as DNS denial of service through NODATA responses. The flaw is classified under [CWE-863: Incorrect Authorization].

Critical Impact
Any authenticated tenant in a multi-pool deployment with AttributeFilter enabled can hijack or disrupt DNS records belonging to other tenants.

Affected Products

OpenStack Designate versions prior to 22.0.1
Multi-pool Designate deployments with AttributeFilter listed in scheduler_filters
Self-service tiering configurations exposing multiple pools to tenants

Discovery Timeline

2026-08-12 - CVE-2026-71193 published to the National Vulnerability Database
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-71193

Vulnerability Analysis

OpenStack Designate provides DNS-as-a-Service across a set of backend pools. Each pool represents an isolated set of DNS servers, and operators can expose multiple pools to tenants for self-service tiering. Zone creation triggers validation checks to prevent overlap: _is_subzone blocks a tenant from creating a zone underneath another tenant's zone, _is_superzone blocks the reverse, and a database constraint prevents duplicate zone names.

These checks query only the pool selected as the scheduling target. When a tenant uses the AttributeFilter scheduler to direct zone creation to a pool that does not contain the conflicting zone, the checks return no match. Designate then commits the overlapping zone. Once the zone is served, the attacker controls records under a namespace assigned to another tenant, enabling traffic redirection or NODATA responses that suppress the legitimate answer.

Root Cause

The root cause is a scoping error in the authorization checks. The overlap validation logic queries the target pool rather than the entire zone catalog, treating pool boundaries as tenant boundaries. This assumption breaks when tenants can influence pool selection through scheduler hints processed by AttributeFilter.

Attack Vector

An attacker requires valid tenant credentials on a Designate deployment configured with multiple pools and AttributeFilter in scheduler_filters. The attacker identifies a target zone owned by another tenant and issues a zone creation request with scheduler hints that route the request to a different pool. Designate skips overlap validation against the pool serving the victim zone and creates the conflicting zone. The attacker then publishes records that shadow or override resolution for the victim's namespace.

No verified public exploit code is available. See the OpenStack Security Advisory and the Launchpad Bug Report for technical details.

Detection Methods for CVE-2026-71193

Indicators of Compromise

Designate zones with identical or overlapping names owned by different project_id values across different pools
Zone creation API calls that include scheduler hints selecting a non-default pool
Unexpected NODATA or divergent answers returned by authoritative servers for tenant-owned domains

Detection Strategies

Query the Designate database for duplicate or hierarchically overlapping zone names across pools and flag any owned by different tenants
Audit Designate API logs for POST /v2/zones requests carrying X-Designate-Scheduler-Hints or pool-selection attributes from non-operator tenants
Correlate authoritative DNS responses across pools to detect resolution divergence for tenant zones

Monitoring Recommendations

Enable verbose logging on the Designate API and central services and forward events to a centralized log store
Alert on zone creation events where the selected pool differs from the tenant's default pool assignment
Monitor for spikes in zone creation activity from a single tenant targeting alternate pools

How to Mitigate CVE-2026-71193

Immediate Actions Required

Upgrade OpenStack Designate to version 22.0.1 or later
Remove AttributeFilter from scheduler_filters in designate.conf if the multi-pool tiering feature is not required
Audit existing zones across all pools for duplicates or overlaps and revoke unauthorized entries

Patch Information

The fix is included in OpenStack Designate 22.0.1. The patch extends the _is_subzone, _is_superzone, and duplicate-zone checks to evaluate the full zone catalog rather than scoping the query to the target pool. Refer to the OpenStack Security Advisory OSSA-2026-034 and the OSS-Security discussion thread for backport details.

Workarounds

Operate Designate with a single pool exposed to tenants until the upgrade is applied
Disable the AttributeFilter scheduler and rely on default pool selection
Restrict scheduler hint acceptance to operator-role accounts through policy configuration

bash

# Configuration example: disable AttributeFilter in designate.conf
[service:central]
scheduler_filters = default_pool

# Verify installed version
openstack --version
pip show designate | grep -i version