Omer Schwartz (Red Hat) discovered a vulnerability in the OpenStack Designate mDNS NOTIFY handler. The _handle_notify() method in designate/mdns/handler.py (lines 90-171) performs a zone lookup using only {name, type='SECONDARY', deleted=False} without pool_id scoping. When zones with the same name exist across different pools, the storage layer's _find() method (designate/storage/sqlalchemy/base.py:270-280) finds 2 results and raises ZoneNotFound (it expects exactly 1 with one=True), causing all NOTIFY processing for the affected zone name to fail with NOTAUTH. This NOTIFY handler path is reachable via unauthenticated UDP on port 5354 (default: 0.0.0.0:5354) because the SerializationMiddleware creates an admin context with all_tenants=True for every request and TSIG enforcement is off by default.

The QUERY and AXFR handlers were previously updated to be pool-aware via _zone_criterion_from_request(), but the NOTIFY handler was not updated.

Colliding zones across pools can be created through CVE-2026-71193 (zone overlap via AttributeFilter) or by administrator action using the PoolIDAttributeFilter.

Affected versions: >=1.0.0 <20.0.2, >=21.0.0 <21.0.1, >=22.0.0 <22.0.1.

Upstream patches provided for master, stable/2025.1, stable/2025.2, and stable/2026.1 branches. Proposed public disclosure: 2026-08-11 1500UTC.

Original private report: https://launchpad.net/bugs/2160533
PSIRT Ticket: PSIRTSUPT-20989
Related CVE: CVE-2026-71193