{"apiVersion":"1.0","identifier":"CVE-2026-71193","description":"In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that conflicts with another tenant-s zone. This enables cross-tenant DNS hijack (redirecting traffic to attacker-controlled IPs) and DNS denial of service (NODATA responses). Exploitation requires a multi-pool deployment with AttributeFilter enabled in scheduler_filters, which is a non-default but documented and supported configuration for self-service tiering.","publishedAt":"2026-08-12T23:17:22","lastModifiedAt":"2026-08-13T14:17:12","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-71193","cvssScore":9.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H","epssProbability":0.0037,"riskScore":0.99,"affectedProduct":"OpenStack Designate","affectedVersions":"<22.0.1","vulnerabilityType":"Library","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-71193","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-71193","en":"https://www.redsauce.net/en/cves/CVE-2026-71193","fr":"https://www.redsauce.net/fr/cves/CVE-2026-71193","pt":"https://www.redsauce.net/pt/cves/CVE-2026-71193","de":"https://www.redsauce.net/de/cves/CVE-2026-71193","sk":"https://www.redsauce.net/sk/cves/CVE-2026-71193","el":"https://www.redsauce.net/el/cves/CVE-2026-71193"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-71193"}}