CVE-2026-71194: OpenStack Designate DoS Vulnerability

CVE-2026-71194 Overview

CVE-2026-71194 affects OpenStack Designate versions before 22.0.2. The vulnerability resides in the mDNS handler, which performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones share the same name across different pools, the lookup fails deterministically. The handler then returns REFUSED for all DNS queries traversing that code path. The _handle_notify path is reachable through a single unauthenticated UDP packet, enabling denial-of-service conditions against DNS resolution. BIND9 views cannot mitigate the flaw because mDNS operates as a shared service upstream of any view configuration.

Critical Impact
An unauthenticated attacker can send a single UDP packet to disable DNS resolution across affected Designate pools, impacting both cross-tenant and legitimate same-tenant cross-pool deployments.

Affected Products

OpenStack Designate versions prior to 22.0.2
Deployments using multiple DNS pools with overlapping zone names
Environments relying on the mDNS shared service for NOTIFY handling

Discovery Timeline

2026-08-12 - CVE-2026-71194 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-71194

Vulnerability Analysis

The flaw is an exposure of resource to the wrong sphere [CWE-669] within OpenStack Designate's mDNS handler. Designate uses pools to group DNS servers serving distinct sets of zones. The mDNS component acts as the internal source-of-truth resolver that answers queries and processes NOTIFY messages from upstream authoritative servers.

The handler retrieves zone records without scoping the lookup to a specific pool. When two zones with identical names exist in different pools, the query returns an ambiguous result and raises a deterministic error. The handler catches the error and responds with REFUSED for every query flowing through that path. Legitimate resolvers stop receiving answers, producing a service-wide denial of service against affected zone names.

Root Cause

The root cause is missing pool context in the zone lookup performed by the mDNS handler. Designate's data model permits identical zone names across pools, but the lookup logic assumes name uniqueness. This design mismatch converts a supported multi-pool configuration into a fatal error condition. The issue also compounds a separate cross-tenant zone overlap vulnerability, since an attacker who can create an overlapping zone in another tenant triggers the same collapse.

Attack Vector

The _handle_notify code path accepts DNS NOTIFY messages over UDP without authentication. An attacker who can reach the mDNS listener sends a single crafted UDP packet referencing a zone name that exists in multiple pools. The handler's failed lookup causes the shared mDNS service to return REFUSED for subsequent queries, disrupting name resolution for legitimate tenants. Exploitation requires no credentials, no user interaction, and no persistent state on the target.

Refer to OpenStack Security Advisory OSSA-2026-034 and Launchpad Bug Report #2160533 for technical details on the affected code paths.

Detection Methods for CVE-2026-71194

Indicators of Compromise

Sudden spikes in REFUSED DNS response codes returned by Designate mDNS instances
Unexpected inbound DNS NOTIFY packets targeting the mDNS listener from unknown sources
Designate logs showing repeated lookup failures on zones with overlapping names across pools

Detection Strategies

Monitor Designate application logs for handler exceptions tied to zone name collisions across pool identifiers
Correlate DNS query failure rates against inbound NOTIFY traffic on mDNS UDP ports
Audit the zone catalog for duplicate zone names spanning multiple pools, which represent latent exploitation triggers

Monitoring Recommendations

Ingest Designate and DNS resolver logs into a centralized analytics platform for rate-based alerting on REFUSED responses
Track NOTIFY packet volumes and source addresses on mDNS interfaces to identify anomalous senders
Alert on any new zone creation event that produces a name collision within the Designate database

How to Mitigate CVE-2026-71194

Immediate Actions Required

Upgrade OpenStack Designate to version 22.0.2 or later on all controller and worker nodes running the mDNS service
Audit existing zones for duplicate names across pools and reconcile or remove collisions before or after patching
Restrict network access to the mDNS UDP listener so only trusted management and DNS infrastructure can send NOTIFY messages

Patch Information

OpenStack has released a fix in Designate 22.0.2. Full details are available in OpenStack Security Advisory OSSA-2026-034 and the Openwall OSS Security Discussion. Operators running older Designate branches should apply the corresponding backported patch referenced in the advisory.

Workarounds

Apply network-level filtering to block untrusted sources from reaching the mDNS UDP port until the patch is deployed
Enforce tenant-level policy to prevent creation of zones whose names duplicate existing zones in other pools
Note that BIND9 views do not mitigate this issue because mDNS is shared upstream of any view configuration

bash

# Example: restrict mDNS UDP listener to trusted management subnet using iptables
iptables -A INPUT -p udp --dport 5354 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p udp --dport 5354 -j DROP