In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that conflicts with another tenant's zone. This enables cross-tenant DNS hijack (redirecting traffic to attacker-controlled IPs) and DNS denial of service (NODATA responses). Exploitation requires a multi-pool deployment with AttributeFilter enabled in scheduler_filters, which is a non-default but documented and supported configuration for self-service tiering.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8860-1 advisory.

    It was discovered that OpenStack Designate did not properly validate overlapping zones under certain     circumstances. An authenticated user could possibly use this issue to redirect DNS traffic to attacker-     controlled systems or cause a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4751 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4751-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/          Carlos Henrique Lima Melara     August 23, 2026                               https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : designate     Version        : 1:15.0.2-0+deb11u1     CVE ID         : CVE-2026-71193 CVE-2026-71194     Debian Bug     : 1144145

    Two security vulnerabilities were discovered in Designate, the OpenStack     DNS-as-a-Service component, which could result in a tenant manipulating     the zones of a different tenant, resulting in denial of service or DNS     hijacking.

    For Debian 12 bookworm, these problems have been fixed in version     1:15.0.2-0+deb11u1.

    We recommend that you upgrade your designate packages.

    For the detailed security status of designate please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/designate

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6452 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6452-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     August 19, 2026                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : designate     CVE ID         : CVE-2026-71193 CVE-2026-71194

    Two security vulnerabilities were discovered in Designate, the OpenStack     DNS-as-a-Service component, which could result in a tenant manipulating     the zones of a different tenant, resulting in denial of service or DNS     hijacking.

    For the stable distribution (trixie), these problems have been fixed in     version 1:20.0.0-2+deb13u1.

    We recommend that you upgrade your designate packages.

    For the detailed security status of designate please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/designate

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
362521	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : OpenStack Designate vulnerability (USN-8860-1)	Nessus	Ubuntu Local Security Checks	Local	critical
339048	Debian dla-4751 : designate - security update	Nessus	Debian Local Security Checks	Local	critical
338177	Debian dsa-6452 : designate - security update	Nessus	Debian Local Security Checks	Local	critical

Detections

Analytics

CVE-2026-71193

critical

Tenable Plugins

critical

critical

critical