CyberRota Analysis
AI-GeneratedOpenStack Designate versions prior to 22.0.1 are vulnerable to critical cross-tenant DNS hijacking and denial of service due to insufficient zone creation checks, allowing authenticated users to create overlapping zones across different pools. This flaw can lead to traffic redirection to attacker-controlled IPs and service disruptions. Organizations using multi-pool deployments with the AttributeFilter enabled in their scheduler_filters should prioritize immediate remediation to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that conflicts with another tenant's zone. This enables cross-tenant DNS hijack (redirecting traffic to attacker-controlled IPs) and DNS denial of service (NODATA responses). Exploitation requires a multi-pool deployment with AttributeFilter enabled in scheduler_filters, which is a non-default but documented and supported configuration for self-service tiering.