Description

In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools, the lookup fails with a deterministic error, causing the handler to return REFUSED for all DNS queries through that path. The _handle_notify path is exploitable via a single unauthenticated UDP packet. This is independently reachable through the cross-tenant zone overlap described in a different recent CVE, and also affects legitimate same-tenant cross-pool configurations. BIND9 views do not mitigate this issue as mDNS is a shared service upstream of any view configuration.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-12T23:17:22.170Z",
  "pubdate": "2026-08-12T23:17:22.170Z",
  "executiveSummary": "OpenStack Designate before version 22.0.2 is vulnerable to a denial of service condition affecting the mDNS handler due to pool-blind lookups during record queries and NOTIFY requests. The presence of two zones with identical names across different resource pools triggers a deterministic resolution failure, causing the mDNS handler to return a REFUSED status for all subsequent DNS queries processed through that execution path. This vulnerability impacts both legitimate multi-tenant configurations and scenarios involving cross-tenant zone overlaps. Crucially, the _handle_notify code path is directly exploitable via a single unauthenticated UDP packet sent over the network. BIND9 views fail to provide mitigation because the mDNS service operates upstream of view configurations. An unauthenticated remote attacker can leverage this flaw to disrupt authoritative DNS resolution services for targeted zones, leading to service degradation and potential availability loss across the affected OpenStack infrastructure.",
  "technicalDetails": "The root cause of this vulnerability lies in the mDNS handler component of OpenStack Designate, specifically within its lookup logic for resolving record queries and handling NOTIFY requests. When the mDNS handler processes incoming requests, it executes pool-blind lookups without adequately scoping the resolution context to the appropriate resource pool when identically named zones exist across distinct pools. This design flaw leads to a deterministic error state whenever duplicate zone names are detected across different pools. Upon encountering this collision, the internal resolution mechanism fails completely and forces the mDNS handler to default to returning a DNS REFUSED response for all DNS queries traversing this specific lookup path. The affected vulnerable component is the Designate mDNS handler, specifically routines handling zone resolution and the _handle_notify code path. This issue affects OpenStack Designate versions prior to 22.0.2. The attack vector is network-exposed, requiring no prior authentication or administrative privileges. Specifically, the _handle_notify execution path can be exploited directly via a single unauthenticated UDP packet injected into the service. The step-by-step attack flow proceeds as follows: First, an attacker identifies or induces the existence of two zones with identical names across different pools within the Designate environment. Second, the attacker transmits a specially crafted UDP packet targeting the _handle_notify path or triggers standard DNS queries that traverse the vulnerable mDNS lookup routine. Third, the mDNS handler attempts a pool-blind lookup, encounters the zone name collision, and triggers the deterministic error condition. Finally, the service responds with REFUSED errors for all queries along that path, denying legitimate access to DNS resolution services. BIND9 views offer no mitigation because mDNS functions as an upstream service that processes requests prior to any BIND9 view evaluation. The post-exploitation impact is a localized or broad denial of service affecting DNS record resolution and synchronization across the designated pools."
}