OpenStack Designate up to 20.0.1/21.0.0/22.0.1 mDNS _handle_notify resource transfer

Summaryinfo

A vulnerability marked as problematic has been reported in OpenStack Designate up to 20.0.1/21.0.0/22.0.1. This affects the function _handle_notify of the component mDNS Handler. The manipulation leads to input validation. This vulnerability is traded as CVE-2026-71194. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in OpenStack Designate up to 20.0.1/21.0.0/22.0.1 and classified as problematic. This issue affects the function _handle_notify of the component mDNS Handler. The manipulation with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-669. The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource. Impacted is availability. The summary by CVE is:

In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools, the lookup fails with a deterministic error, causing the handler to return REFUSED for all DNS queries through that path. The _handle_notify path is exploitable via a single unauthenticated UDP packet. This is independently reachable through the cross-tenant zone overlap described in a different recent CVE, and also affects legitimate same-tenant cross-pool configurations. BIND9 views do not mitigate this issue as mDNS is a shared service upstream of any view configuration.

The advisory is shared at launchpad.net. The identification of this vulnerability is CVE-2026-71194 since 08/05/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 339048 (Debian dla-4751 : designate - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 20.0.2, 21.0.1 or 22.0.2 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (339048) and EUVD (EUVD-2026-57692). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Cloud Software

Vendor

• OpenStack

Name

• Designate

Version

• 20.0.0
• 20.0.1
• 21.0
• 22.0.0
• 22.0.1

License

• free

Website

• Vendor: https://www.openstack.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion