Openstack Designate vulnerabilities

4 CVEs affecting Openstack Designate, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-71194, published 2026-08-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-5695, published 2017-08-31. Medium severity, CVSS 6.5. EPSS: 2.1% chance of exploitation in the next 30 days. Designate 2015.1.0 through 1.0.0.0b1 as packaged in OpenStack Kilo does not enforce RecordSets per domain, and Records per RecordSet quotas when processing an internal zone file transfer, which might…
CVE-2015-5694, published 2019-11-22. Medium severity, CVSS 6.5. EPSS: 1.8% chance of exploitation in the next 30 days. Designate does not enforce the DNS protocol limit concerning record set sizes
CVE-2026-71193, published 2026-08-12. Critical severity, CVSS 9.6. EPSS: 0.5% chance of exploitation in the next 30 days. In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authenticated user can bypass…
CVE-2026-71194, published 2026-08-12. Medium severity, CVSS 6.8. EPSS: 0.5% chance of exploitation in the next 30 days. In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools,…