External risk intelligence

OpenStack Designate Zone Creation Vulnerability Allows DNS Hijack and DoS

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-71193

The vulnerability resides in OpenStack Designate, a cloud infrastructure component typically restricted to internal cloud management networks. Exploitation requires a specific, non-default configuration (multi-pool deployment with AttributeFilter enabled), making public internet exposure of this vulnerable interface uncommon.

Denial of Service

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in OpenStack Designate, a component used for DNS management in cloud environments. This issue could allow an authenticated user to create overlapping DNS zones, potentially leading to traffic redirection to attacker-controlled destinations or denial-of-service attacks affecting other tenants within the same cloud. Exploitation requires a specific, non-default configuration, but if present, it could enable significant disruption.

Unauthenticated users can hijack DNS.
Affects cross-tenant DNS integrity and availability.
Confirm exposure and assess impact.

Attack Path

How an attacker could exploit the issue

An attacker with authenticated access could create a DNS zone that overlaps with a zone belonging to another tenant. This is possible by exploiting checks that are only scoped to a single pool, and then using the AttributeFilter scheduler to place the zone in a different pool. This could allow the attacker to redirect traffic or cause denial of service for the targeted tenant.

Authenticated access is required.
Zone creation with AttributeFilter scheduler.
Cross-tenant DNS hijack or DoS.

Live Threat

Current exploitation, exposure, and threat context

An authenticated user with specific access could create overlapping DNS zones in a multi-pool OpenStack Designate deployment, leading to cross-tenant DNS hijacking or denial of service, but only when the AttributeFilter scheduler is enabled.

Tenant DNS zone data.
Zone creation checks are bypassed.
Cross-tenant DNS hijacking is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in OpenStack Designate affects deployments configured with multiple pools and the AttributeFilter scheduler enabled. The first step is to identify all instances of Designate, confirm if they meet these specific configuration requirements, and assess their network exposure and criticality to determine the accountable owner and prioritize remediation.

Identify affected Designate deployments.
Verify AttributeFilter scheduler configuration.
Plan remediation with relevant teams.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OpenStack Designate?

OpenStack Designate is a multi-tenant DNS-as-a-Service component. It allows cloud users to manage DNS zones and records programmatically within an OpenStack environment, effectively acting as the authoritative DNS server for cloud-hosted applications and services.

What does CWE-863 mean for CVE-2026-71193?

CWE-863 refers to Incorrect Authorization. In this CVE, the software fails to properly verify if a user has permission to create a zone that conflicts with another tenant. Because the checks are incorrectly limited to the target pool, an authenticated user can bypass authorization logic to create overlapping zones.

How can an attacker trigger this vulnerability?

An attacker must have authenticated access and target a deployment using multiple DNS pools with the AttributeFilter scheduler enabled. The bug cannot be triggered in standard, single-pool deployments, as the vulnerability specifically relies on moving a zone to a different pool to evade initial creation constraints.

Is my cloud environment at risk according to Halo Surface Signal?

Halo Surface Signal indicates that risk is unlikely for most users. Because Designate typically resides on internal management networks and the vulnerability requires a rare, non-default configuration, public internet exposure of this specific attack path is uncommon.

What should I do if I run OpenStack Designate?

First, verify if your deployment utilizes multiple DNS pools and has the AttributeFilter scheduler enabled. If you use this specific configuration, prioritize reviewing your zone management policies and prepare to update your software to version 22.0.1 or later to apply the necessary checks.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.