OpenStack Designate versions 1.0.0, 21.0.0, and 22.0.0 are affected by an incorrect authorization vulnerability (CWE-863) where zone creation checks are scoped only to the target pool. An authenticated user can exploit this by scheduling a zone to a different pool using the AttributeFilter scheduler, which is a supported but non-default configuration. This enables the creation of overlapping zones that conflict with other tenants' zones, resulting in cross-tenant DNS hijack and DNS denial of service (NODATA responses). The vulnerability requires a multi-pool deployment with AttributeFilter enabled in scheduler_filters. The CVSS 3.1 base score is 9.6, indicating critical severity with network attack vector, low attack complexity, and requiring low privileges but no user interaction.

The vulnerability allows an authenticated attacker to bypass authorization checks and create overlapping DNS zones in other tenants' pools. This can lead to DNS hijacking, redirecting traffic to attacker-controlled IP addresses, and DNS denial of service by causing NODATA responses. The impact affects confidentiality and integrity of DNS data across tenants and availability of DNS services.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling the AttributeFilter scheduler or avoid multi-pool deployments with this configuration to mitigate the risk. Monitoring for unauthorized zone creations in multi-tenant environments is advised.