YAOOK Security Advisory for CVE-2026-71193 and CVE-2026-71194

What are CVE-2026-71193 and CVE-2026-71194, and how do they affect YAOOK?

Tore Anderson (Redpill Linpro AS) reported a vulnerability in OpenStack Designate zone scheduling. An authenticated tenant can bypass zone ownership checks by scheduling a zone to a different pool, creating overlapping zones that hijack or deny service to another tenant’s DNS records. Any user with the default `create_zone` policy can exploit this when the AttributeFilter scheduler is enabled. Only deployments using the AttributeFilter scheduler with multiple pools are affected.

Omer Schwartz (Red Hat) discovered a related vulnerability in the Designate mDNS handler during triage. The mDNS handler performs pool-blind record lookups which fail when there are conflicting zones across pools, causing deterministic DNS query failures. The NOTIFY handler path is accessible via unauthenticated UDP.

Is my cluster vulnerable?

The following images are vulnerable:
  • designate images prior to version 1.0.29
  • yaook release prior to 3.3.0
If this image is used in your cluster for the designated deployment, the cluster is vulnerable.
 
The fixed image has been built in a private pipeline which has been published alongside this advisory to prove the image provenance.

Upgrading

A new stable release will be published according to the release cycle and hotfix releases will be produced starting now. You can upgrade to that release simply by updating your operators.
 
However, we recommend adding a YAOOK_OP_VERSIONS_OVERRIDE Add this variable to your Designate operator container to pull the image before the YAOOK comprehensive release is ready.
 
The best way to do this is to set the following in the `values.yaml` file of your `designate-operator` (make sure to merge this correctly with any existing `values.yaml` file, if you have one).
operator:
    extraEnv:
    - name: YAOOK_OP_VERSIONS_OVERRIDE
    value: |
 {
 "registry.yaook.cloud/yaook/designate-2024.1": "registry.yaook.cloud/yaook/designate-2024.1:1.0.29",
 "registry.yaook.cloud/yaook/designate-2024.2": "registry.yaook.cloud/yaook/designate-2024.2:1.0.29",
 "registry.yaook.cloud/yaook/designate-2025.1": "registry.yaook.cloud/yaook/designate-2025.1:1.0.29",
            "registry.yaook.cloud/yaook/designate-2025.2": "registry.yaook.cloud/yaook/designate-2025.2:1.0.29",
            "registry.yaook.cloud/yaook/designate-2026.1": "registry.yaook.cloud/yaook/designate-2026.1:1.0.29"
 }
If you are not using Helm, you can add the environment variable to the env section of your designated operator’s deployment’s pod template.
de_DE_formal
de_DE_formal