OpenStack Designate bugs allow cross-tenant DNS zone collisions
Two flaws in multi-pool setups let tenants overlap other tenants' zones, enabling hijacks and a deterministic mDNS denial of service.
OpenStack has issued OSSA-2026-034 for Designate, its DNS-as-a-service project, covering two flaws that affect every deployment using more than one pool.
CVE-2026-71193 is a missing ownership check when a zone is scheduled onto a non-default pool through the attribute filter. A tenant can create a sub-zone, super-zone, or exact duplicate of another tenant's zone in a different pool, which can lead to DNS hijacking or denial of service.
CVE-2026-71194 is an independent denial-of-service path: the mDNS handler resolves records without regard to pool, so colliding zones across pools produce a deterministic outage.
Tore Anderson of Redpill Linpro AS reported the cross-pool ownership gap. Omer Schwartz of Red Hat found the pool-blind mDNS lookups. Affected releases are Designate from 1.0.0 before 20.0.2, plus 21.0.0 and 22.0.0. Fixed point releases are available on the supported stable branches.
Operators should audit existing zones for cross-tenant collisions created before the fix. OpenStack expects to publish a separate detection tool for that cleanup.