EUVD-2026-57689
GHSA-8f9r-f5gr-x4fc
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
Authenticated tenant (PR:L) exploits over the API (AV:N/AC:L) breaking cross-tenant isolation (S:C) to hijack/deny DNS (I:H/A:H); no data disclosure (C:N).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that conflicts with another tenant's zone. This enables cross-tenant DNS hijack (redirecting traffic to attacker-controlled IPs) and DNS denial of service (NODATA responses). Exploitation requires a multi-pool deployment with AttributeFilter enabled in scheduler_filters, which is a non-default but documented and supported configuration for self-service tiering.
AnalysisAI
Cross-tenant DNS hijacking and denial of service in OpenStack Designate before 22.0.1 allows an authenticated tenant to bypass zone-ownership and duplicate-zone checks. Because the _is_subzone, _is_superzone, and duplicate-zone database constraint are evaluated only against the target pool, a user can schedule a zone to a different pool via the AttributeFilter scheduler and create a zone that overlaps another tenant's, redirecting DNS traffic to attacker-controlled IPs or forcing NODATA responses. Fixed versions (22.0.1, 21.0.1, 20.0.2) are available from the vendor; no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Technical ContextAI
Designate is the DNS-as-a-Service component of OpenStack, providing multi-tenant authoritative DNS with zones stored in a database and served through backend DNS servers organized into 'pools.' Large deployments use multiple pools to offer self-service tiering, and the AttributeFilter scheduler lets tenants direct zone creation to a specific pool based on attributes. The root cause is CWE-863 (Incorrect Authorization): the integrity checks that prevent overlapping or duplicate zones - subzone/superzone hierarchy validation and the duplicate-zone DB uniqueness constraint - are scoped per-pool rather than globally across the deployment. Affected component is cpe:2.3:a:openstack:designate, and because DNS authority is global by nature, per-pool scoping of a global namespace check is the design defect an attacker leverages.
RemediationAI
Upgrade to a fixed release: Vendor-released patch 22.0.1 for the 22.0.x line, 21.0.1 for the 21.0.x line, or 20.0.2 for older 1.0.0-20.x deployments, per OSSA-2026-034 (https://security.openstack.org/ossa/OSSA-2026-034.html). If immediate patching is not possible, the most direct compensating control is to remove AttributeFilter from the scheduler_filters configuration, which closes the cross-pool scheduling path an attacker needs - the trade-off is loss of tenant self-service pool selection/tiering functionality. Alternatively, consolidating to a single pool eliminates the cross-pool scope gap but removes multi-pool tiering entirely; where multi-pool must remain, restrict which tenants may target pools and audit existing zones for cross-tenant overlaps before and after upgrading. Refer to the launchpad bug (https://launchpad.net/bugs/2160533) and the oss-security post (https://www.openwall.com/lists/oss-security/2026/08/11/6) for details.
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2
Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote
The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users w
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addres
The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an int
An issue in OpenStack magnum yoga-eom version allows a remote attacker to execute arbitrary code via the cert_manager.py
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4
glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causin
Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remot
Code injection in OpenStack Vitrage query parser allows authenticated users to execute arbitrary Python code through cra
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today