CVE-2026-76878

Name of the Vulnerable Software and Affected Versions OpenStack Aodh versions prior to 22.0.1 OpenStack Watcher versions 4.0.0 and later

Description In OpenStack Aodh, the alarm list API fails to properly enforce project scoping when the all projects query parameter is set to false. The system checks for the existence of the all projects key instead of validating its value. While a true value triggers administrator-only policies, a false value causes the system to skip the restriction branch that limits results to the caller's project. Consequently, a non-admin user with the reader role can list alarms across all projects, exposing sensitive metadata such as trust webhook URLs, Heat signal endpoints, project IDs, and user IDs. This can be further exploited by combining the parameter with a foreign project id to target specific projects. Additionally, OpenStack Watcher does not apply authorization to its webhook trigger endpoint. An authenticated user who obtains a webhook URL through the Aodh leak can initiate an EVENT audit and its associated action plan, bypassing project and role restrictions.

Recommendations Update OpenStack Aodh to version 22.0.1 or later. Restrict access to the OpenStack Watcher webhook trigger endpoint to authorized users only.