{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71194", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-08-05T05:15:39.832Z", "datePublished": "2026-08-12T22:23:46.951Z", "dateUpdated": "2026-08-13T13:32:41.548Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Designate", "repo": "https://opendev.org/openstack/designate", "vendor": "OpenStack", "versions": [{"lessThan": "20.0.2", "status": "affected", "version": "1.0.0", "versionType": "semver"}, {"lessThan": "21.0.1", "status": "affected", "version": "21.0.0", "versionType": "semver"}, {"lessThan": "22.0.2", "status": "affected", "version": "22.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools, the lookup fails with a deterministic error, causing the handler to return REFUSED for all DNS queries through that path. The _handle_notify path is exploitable via a single unauthenticated UDP packet. This is independently reachable through the cross-tenant zone overlap described in a different recent CVE, and also affects legitimate same-tenant cross-pool configurations. BIND9 views do not mitigate this issue as mDNS is a shared service upstream of any view configuration."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-669", "description": "CWE-669 Incorrect Resource Transfer Between Spheres", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-08-12T22:23:46.951Z"}, "references": [{"tags": ["issue-tracking"], "url": "https://launchpad.net/bugs/2160533"}, {"tags": ["vendor-advisory"], "url": "https://security.openstack.org/ossa/OSSA-2026-034.html"}, {"tags": ["issue-tracking", "vendor-advisory", "mailing-list"], "url": "https://www.openwall.com/lists/oss-security/2026/08/11/6"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:openstack:designate:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0.0", "versionEndExcluding": "20.0.2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:openstack:designate:*:*:*:*:*:*:*:*", "versionStartIncluding": "21.0.0", "versionEndExcluding": "21.0.1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:openstack:designate:*:*:*:*:*:*:*:*", "versionStartIncluding": "22.0.0", "versionEndExcluding": "22.0.2"}]}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-13T13:31:40.754720Z", "id": "CVE-2026-71194", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T13:32:41.548Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-71194", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T13:31:40.754720Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T13:32:38.575Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://opendev.org/openstack/designate", "vendor": "OpenStack", "product": "Designate", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "20.0.2", "versionType": "semver"}, {"status": "affected", "version": "21.0.0", "lessThan": "21.0.1", "versionType": "semver"}, {"status": "affected", "version": "22.0.0", "lessThan": "22.0.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://launchpad.net/bugs/2160533", "tags": ["issue-tracking"]}, {"url": "https://security.openstack.org/ossa/OSSA-2026-034.html", "tags": ["vendor-advisory"]}, {"url": "https://www.openwall.com/lists/oss-security/2026/08/11/6", "tags": ["issue-tracking", "vendor-advisory", "mailing-list"]}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools, the lookup fails with a deterministic error, causing the handler to return REFUSED for all DNS queries through that path. The _handle_notify path is exploitable via a single unauthenticated UDP packet. This is independently reachable through the cross-tenant zone overlap described in a different recent CVE, and also affects legitimate same-tenant cross-pool configurations. BIND9 views do not mitigate this issue as mDNS is a shared service upstream of any view configuration."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-669", "description": "CWE-669 Incorrect Resource Transfer Between Spheres"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openstack:designate:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "20.0.2", "versionStartIncluding": "1.0.0"}, {"criteria": "cpe:2.3:a:openstack:designate:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "21.0.1", "versionStartIncluding": "21.0.0"}, {"criteria": "cpe:2.3:a:openstack:designate:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "22.0.2", "versionStartIncluding": "22.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-08-12T22:23:46.951Z"}}}, "cveMetadata": {"cveId": "CVE-2026-71194", "state": "PUBLISHED", "dateUpdated": "2026-08-13T13:32:41.548Z", "dateReserved": "2026-08-05T05:15:39.832Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-08-12T22:23:46.951Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Designate", "repo": "https://opendev.org/openstack/designate", "vendor": "OpenStack", "versions": [{"lessThan": "20.0.2", "status": "affected", "version": "1.0.0", "versionType": "semver"}, {"lessThan": "21.0.1", "status": "affected", "version": "21.0.0", "versionType": "semver"}, {"lessThan": "22.0.2", "status": "affected", "version": "22.0.0", "versionType": "semver"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools, the lookup fails with a deterministic error, causing the handler to return REFUSED for all DNS queries through that path. The _handle_notify path is exploitable via a single unauthenticated UDP packet. This is independently reachable through the cross-tenant zone overlap described in a different recent CVE, and also affects legitimate same-tenant cross-pool configurations. BIND9 views do not mitigate this issue as mDNS is a shared service upstream of any view configuration."}], "id": "CVE-2026-71194", "lastModified": "2026-09-09T16:03:22.897", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 4.0, "source": "cve@mitre.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71194", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-13T13:31:40.754720Z", "version": "2.0.3"}}]}, "published": "2026-08-12T23:17:22.170", "references": [{"source": "cve@mitre.org", "url": "https://launchpad.net/bugs/2160533"}, {"source": "cve@mitre.org", "url": "https://security.openstack.org/ossa/OSSA-2026-034.html"}, {"source": "cve@mitre.org", "url": "https://www.openwall.com/lists/oss-security/2026/08/11/6"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-669"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{"acknowledgement": "Upstream acknowledges Omer Schwartz (Red Hat) and Tore Anderson (Redpill Linpro AS) as the original reporters.", "bugzilla": {"description": "openstack-designate: designate: mDNS NOTIFY handler DoS via pool-blind zone lookup", "id": "2512060", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512060"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-863", "details": ["A flaw was found in the OpenStack Designate mDNS NOTIFY handler. The _handle_notify method performs zone lookups without pool_id scoping, unlike the QUERY and AXFR handlers which were previously updated to be pool-aware. When zones with the same name exist across different DNS pools, the storage layer finds multiple matches and raises a NotFound exception, causing all NOTIFY processing for the affected zone name to fail. This results in denial of service for DNS zone transfer notifications, causing stale zone data on secondary DNS servers. The mDNS NOTIFY path is reachable via unauthenticated UDP on port 5354."], "mitigation": {"lang": "en:us", "value": "Restrict network access to the mDNS service port (default 5354/UDP and TCP) using firewall rules, allowing only traffic from known DNS master servers. Note that enabling the 'query_enforce_tsig' option does NOT protect the NOTIFY handler path, as it only applies to QUERY and AXFR operations.\nTo prevent the precondition of colliding zones: verify that the 'scheduler_filters' configuration option in the [service:central] section uses 'default_pool' (the default) or 'pool_id_attribute' instead of 'attribute'. This prevents unauthorized creation of zones in alternative pools."}, "name": "CVE-2026-71194", "package_state": [{"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Fix deferred", "impact": "moderate", "package_name": "openstack-designate", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Fix deferred", "package_name": "openstack-designate", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Fix deferred", "package_name": "openstack-designate", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Fix deferred", "package_name": "openstack-designate", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2026-08-11T15:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-71194\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-71194\nhttps://launchpad.net/bugs/2160533"], "statement": "Red Hat OpenStack Platform (RHOSP) ships Designate across multiple versions. The mDNS NOTIFY handler DoS can occur whenever zone names collide across pools, regardless of how the colliding zones were created. However, in default configurations, only a single pool is used, making collisions unlikely without administrator action or exploitation of CVE-2026-71193. Multipool deployments using the AttributeFilter scheduler were never a fully supported configuration in any RHOSP version.\nIn RHOSP 13, 16.2, and 17.1 (TripleO deployment), the mDNS service listens on port 5354/UDP by default and does not require authentication for the NOTIFY handler path.\nFor Red Hat OpenStack Services on OpenShift (RHOSO, openstack-18.0), the mDNS service defaults to a ClusterIP service type with no NodePort or LoadBalancer exposure, making port 5354 reachable only within the OpenShift cluster network. This significantly limits the attack surface for the mDNS DoS.", "threat_severity": "Moderate"}