CVE-2026-71193 Missing authorization in Designate
Authenticated users can bypass zone validation in multi-pool OpenStack Designate deployments to hijack DNS or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-71193?
CVE-2026-71193 is a critical missing authorization vulnerability in OpenStack Designate, published on 12 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that conflicts with another tenant's zone. This enables cross-tenant DNS hijack (redirecting traffic to attacker-controlled IPs) and DNS denial of service (NODATA responses). Exploitation requires a multi-pool deployment with AttributeFilter enabled in scheduler_filters, which is a non-default but documented and supported configuration for self-service tiering.
Weakness: CWE-863
Which versions are affected by CVE-2026-71193?
How do I fix CVE-2026-71193?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-71193 being exploited?
There is no known exploitation of CVE-2026-71193 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-71193, GHSA-8f9r-f5gr-x4fc, UBUNTU-CVE-2026-71193, USN-8860-1.