CVE-2026-71193

In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that conflicts with another tenant's zone. This enables cross-tenant DNS hijack (redirecting traffic to attacker-controlled IPs) and DNS denial of service (NODATA responses). Exploitation requires a multi-pool deployment with AttributeFilter enabled in scheduler_filters, which is a non-default but documented and supported configuration for self-service tiering.

• CWE-863

• https://launchpad.net/bugs/2160533
• https://security.openstack.org/ossa/OSSA-2026-034.html
• https://www.openwall.com/lists/oss-security/2026/08/11/6

Published

Aug 12, 2026

Last Modified

Sep 9, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-71182Dell Update Package Framework, versions prior to 26.07.03, c…6
• CVE-2026-71187The Ebyte device relies on client side authentication logic …9.8
• CVE-2026-7119A vulnerability was detected in Tenda HG3 2.0. The impacted …8.8
• CVE-2026-71190In OpenStack Swift through 2.38.0, the proxy server Accept h…8.7
• CVE-2026-71191In OpenStack Swift through 2.38.0, S3API middleware does not…6
• CVE-2026-71192In OpenStack Swift through 2.38.0, the S3API middleware does…6
• CVE-2026-71194In OpenStack Designate before 22.0.2, the mDNS handler perfo…6.8
• CVE-2026-71198In OpenStack Glance before 32.0.1, the location API does not…7
• CVE-2026-7120@fastify/static evaluates the allowedPath callback before no…5.3
• CVE-2026-71201In OpenStack Ironic through 38.0.0, a project reader that ma…5
• CVE-2026-71202The raster Rust crate's crop function (src/editor.rs) clamps…7.5
• CVE-2026-71203changedetection.io's REST API resources are protected by an …5.3