Medium [CVE-2026-71193] cross-tenant DNS zone overlap via pool-scoped ownership checks when using AttributeFilter scheduler
This medium-severity Red Hat Linux advisory covers CVE-2026-71193 affecting Red Hat OpenStack Platform 13 (Queens), Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
A flaw was found in OpenStack Designate. When the AttributeFilter scheduler is enabled with multiple DNS pools, an authenticated tenant can bypass zone ownership checks by scheduling a zone to a different pool.
The database uniqueness constraint on zone names is pool-scoped, and the subzone/superzone ownership checks in the Central service include pool_id in their query criteria, making them pool-scoped rather than global. This allows a tenant to create zones that overlap with another tenant's zones in a different pool, bypassing cross-tenant namespace isolation.
Successful exploitation could lead to cross-tenant DNS zone overlap and subzone ownership bypass. Multipool deployments using the AttributeFilter scheduler were never a fully supported configuration in any RHOSP version.
In RHOSP 13, 16.2, and 17.1 (TripleO deployment), the default scheduler_filters configuration is default_pool, which assigns all zones to a single pool and prevents the cross-tenant zone overlap.
The pool_id_attribute filter enforces the zone_create_forced_pool policy check, which defaults to requiring the SYSTEM_ADMIN role, preventing regular tenants from selecting pools. Therefore, RHOSO is not affected in the default configuration.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Mitigation checklist
- For deployments not using multi-pool DNS: verify that the 'scheduler_filters' configuration option in the [service:central] section only contains 'default_pool' (the default value). This prevents tenants from selecting alternative pools and eliminates the zone overlap vulnerability. For deployments using multi-pool DNS: replace the 'attribute' filter with 'pool_id_attribute' in the 'scheduler_filters' configuration. The pool_id_attribute filter enforces the 'zone_create_forced_pool' policy check, which defaults to requiring the SYSTEM_ADMIN role, preventing regular tenants from choosing pools.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.