OpenStack Designate before version 22.0.1 incorrectly scopes zone‑creation checks to the target pool solely. An authenticated user can thus create a zone in a different pool that overlaps an existing zone belonging to another tenant. The resulting overlapping zone redirects queries for the victim tenant’s domain, allowing the attacker to hijack DNS traffic to attacker‑controlled IP addresses. At the same time, the redirection can cause legitimate queries to return NODATA responses, effectively denying service to the victim tenant’s domain. This flaw is a type of authorization bypass (CWE‑863).

The vulnerability exists in OpenStack Designate components where multi‑pool deployments are configured, specifically when the AttributeFilter scheduler is enabled. Users deploying Designate with multiple storage pools and self‑service tiering via AttributeFilter are affected. The issue is present in releases prior to 22.0.1; versions 22.0.1 and later contain the fix.

The CVSS score of 9.6 indicates a high‑severity impact. Exploitation requires an authenticated user, a non‑default but documented configuration (multi‑pool deployment with AttributeFilter), and the ability to schedule zones to a different pool. Because the EPSS score is not available, the likelihood of exploitation is uncertain, but the flaw is not yet listed in the CISA KEV catalog. The attack vector is inferred to be remote, through the OpenStack Designate API, and the threat is significant for any tenant with DNS records in a multi‑pool environment.