Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-71193

Quick assessment

Affected

OpenStack Designate

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenStack Designate是OpenStack基金会开源的一个提供DNS服务的组件。 OpenStack Designate 22.0.1之前版本存在授权问题漏洞，该漏洞源于区域创建检查仅针对目标池，攻击者可通过AttributeFilter调度器将区域调度至不同池，绕过检查并创建重叠区域，导致跨租户DNS劫持和DNS拒绝服务。

CVSS 9.6 · Critical EPSS 0.53% · P45 Updated Aug 13, 2026

Possible ATT&CK Techniques 2 AI

T1048 · Exfiltration Over Alternative Protocol T1190 · Exploit Public-Facing Application

Affected Version Matrix 3

Vendor	Product	Version Range	Status
OpenStack	Designate	`1.0.0< 20.0.2`	affected
		`21.0.0< 21.0.1`	affected
		`22.0.0< 22.0.1`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-71193

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

N/A

Source: CVE Program / CVE List V5

Vulnerability Description

In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that conflicts with another tenant's zone. This enables cross-tenant DNS hijack (redirecting traffic to attacker-controlled IPs) and DNS denial of service (NODATA responses). Exploitation requires a multi-pool deployment with AttributeFilter enabled in scheduler_filters, which is a non-default but documented and supported configuration for self-service tiering.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制不正确

Source: CVE Program / CVE List V5

Vulnerability Title

OpenStack Designate 授权问题漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
OpenStack	Designate	1.0.0 ~ 20.0.2	-

II. Public POCs for CVE-2026-71193

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-71193

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-71193 (2)

🔗 403 Forbidden vendor-advisory
🔗 Bug #2160533 “[OSSA-2026-034] Designate cross-tenant DNS zone ov...” : Bugs : Designate Read full article issue-tracking

Mailing List Discussions for CVE-2026-71193 (1)

🔗 oss-security - [OSSA-2026-034] OpenStack Designate: Cross-tenant DNS zone overlap and mDNS DoS via pool scheduling (CVE-2026-71193, CVE-2026-71194) Read full article vendor-advisory mailing-list

https://www.cve.org/CVERecord?id=CVE-2026-71193

IV. Related Vulnerabilities

Same product: Designate

CVE-2026-71194
OpenStack Designate 权限许可和访问控制问题漏洞

Same vendor: OpenStack

Same weakness: CWE-863