{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-71193 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"CVE-2026-71193 is a critical missing authorization vulnerability in OpenStack Designate, published on 12 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-71193 and fix it if it is affected.\n\nWhat it is: CVE-2026-71193 is a critical missing authorization vulnerability in OpenStack Designate, published on 12 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-71193 in the wild and no public exploit code.\n\nAffected product: OpenStack Designate. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-71193/ (Markdown: https://insights.sbomify.com/CVE-2026-71193/index.md)","id":"CVE-2026-71193","markdown":"https://insights.sbomify.com/CVE-2026-71193/index.md","name":"CVE-2026-71193","record":{"aliases":["DEBIAN-CVE-2026-71193","GHSA-8f9r-f5gr-x4fc","UBUNTU-CVE-2026-71193","USN-8860-1"],"analysis":{"component_type":"cloud_service","fix_type":"upgrade","impacts":["data_modify","denial_of_service"],"network_reachable":"yes","non_default_config":true,"product_category":"OpenStack DNS service","requires_auth":"low_privilege","summary":"Authenticated users can bypass zone validation in multi-pool OpenStack Designate deployments to hijack DNS or cause denial of service.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"mitre","cpe":[],"cvss":{"score":9.6,"severity":"critical","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-863","name":"Incorrect Authorization"}],"description":"In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that conflicts with another tenant's zone. This enables cross-tenant DNS hijack (redirecting traffic to attacker-controlled IPs) and DNS denial of service (NODATA responses). Exploitation requires a multi-pool deployment with AttributeFilter enabled in scheduler_filters, which is a non-default but documented and supported configuration for self-service tiering.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Missing authorization in Designate","id":"CVE-2026-71193","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"missing_authorization","year":"2026"},"n_packages":0,"n_references":3,"next":{"headline":"Denial of service in Designate","id":"CVE-2026-71194"},"packages":[],"prev":{"headline":"Missing authorization in Swift","id":"CVE-2026-71192"},"products":["Designate"],"published":"2026-08-12","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-08-13","vendors":["OpenStack"]},"summary":"Authenticated users can bypass zone validation in multi-pool OpenStack Designate deployments to hijack DNS or cause denial of service.","url":"https://insights.sbomify.com/CVE-2026-71193/"}