In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that conflicts with another tenant's zone. This enables cross-tenant DNS hijack (redirecting traffic to attacker-controlled IPs) and DNS denial of service (NODATA responses). Exploitation requires a multi-pool deployment with AttributeFilter enabled in scheduler_filters, which is a non-default but documented and supported configuration for self-service tiering.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4751 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4751-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/          Carlos Henrique Lima Melara     August 23, 2026                               https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : designate     Version        : 1:15.0.2-0+deb11u1     CVE ID         : CVE-2026-71193 CVE-2026-71194     Debian Bug     : 1144145

    Two security vulnerabilities were discovered in Designate, the OpenStack     DNS-as-a-Service component, which could result in a tenant manipulating     the zones of a different tenant, resulting in denial of service or DNS     hijacking.

    For Debian 12 bookworm, these problems have been fixed in version     1:15.0.2-0+deb11u1.

    We recommend that you upgrade your designate packages.

    For the detailed security status of designate please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/designate

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6452 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6452-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     August 19, 2026                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : designate     CVE ID         : CVE-2026-71193 CVE-2026-71194

    Two security vulnerabilities were discovered in Designate, the OpenStack     DNS-as-a-Service component, which could result in a tenant manipulating     the zones of a different tenant, resulting in denial of service or DNS     hijacking.

    For the stable distribution (trixie), these problems have been fixed in     version 1:20.0.0-2+deb13u1.

    We recommend that you upgrade your designate packages.

    For the detailed security status of designate please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/designate

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-     zone DB constraint) are scoped to the target pool only. An authenticated user can bypass these checks by     scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that     conflicts with another tenant's zone. This enables cross-tenant DNS hijack (redirecting traffic to     attacker-controlled IPs) and DNS denial of service (NODATA responses). Exploitation requires a multi-pool     deployment with AttributeFilter enabled in scheduler_filters, which is a non-default but documented and     supported configuration for self-service tiering. (CVE-2026-71193)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
339048	Debian dla-4751 : designate - security update	Nessus	Debian Local Security Checks	Local	critical
338177	Debian dsa-6452 : designate - security update	Nessus	Debian Local Security Checks	Local	critical
334571	Linux Distros Unpatched Vulnerability : CVE-2026-71193	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-71193

critical

Tenable Plugins

critical

critical

critical