Skip to content
Fencer Vulns
high 8.4

CVE-2026-76878 json

In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the all_projects query parameter is set to false.

published 2026-08-19 2 mo ago modified 2026-09-09 2 mo ago also EUVD-2026-63137

cvss
8.4
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 45%
public exploits
0
none known

Summary

In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the all_projects query parameter is set to false. The API checks for the presence of the all_projects key rather than its value; a true value enforces the administrator-only policy, but a false value removes the key and skips the branch that normally restricts results to the caller's project. A non-admin user with the reader role can list alarms from all projects, exposing alarm actions containing trust webhook URLs, Heat signal endpoints, project IDs, and user IDs. The parameter can also be combined with a foreign project_id to target a specific project's alarms. A related concern is that OpenStack Watcher does not apply authorization to its webhook trigger endpoint. Any authenticated user who learns an audit's webhook URL, for example from this leaked Aodh alarm metadata, can start an EVENT audit and its associated action plan regardless of their own project or role. The webhook endpoint has lacked policy enforcement since its introduction in the Ussuri release (Watcher 4.0.0).

Patch / fix

  • OpenStack Aodh 20.0.1, 21.0.1, 22.0.1
  • aodh Debian 14 22.0.0-3
  • watcher Debian 14 16.0.0-5

debian advisories DEBIAN-CVE-2026-76878

  • aodh Ubuntu 22.04 LTS 1:14.1.0-0ubuntu1.1
  • aodh Ubuntu 24.04 LTS 1:18.0.0-0ubuntu1.1
  • aodh Ubuntu 26.04 LTS 1:22.0.0-0ubuntu1.1
  • aodh Ubuntu Pro 20.04 LTS 10.0.0-0ubuntu0.20.04.1+esm1
  • watcher Ubuntu Pro 20.04 LTS 1:4.0.0-0ubuntu0.20.04.1+esm1
  • watcher Ubuntu Pro 22.04 LTS 2:8.0.0-0ubuntu1.2+esm1
  • watcher Ubuntu Pro 24.04 LTS 2:12.0.0-0ubuntu1.3+esm1
  • watcher Ubuntu Pro 26.04 LTS 2:16.0.0-0ubuntu1+esm1

ubuntu advisories UBUNTU-CVE-2026-76878

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-76878 updated cvss 6.3

aodh: python-watcher: aodh / python-watcher: cross-project alarm enumeration and webhook missing authorization

  • Red Hat OpenStack Platform 16.2 python3-aodh, openstack-aodh-api, openstack-aodh-common, openstack-aodh-compat, openstack-aodh-expirer, openstack-aodh-listener, +7 more
    affected: workaround, no fix available, no fix planned “Out of support scope”
  • Red Hat OpenStack Platform 17.1 python3-aodh, openstack-aodh-api, openstack-aodh-common, openstack-aodh-compat, openstack-aodh-expirer, openstack-aodh-listener, +2 more Red Hat OpenStack Platform 18.0 openstack-aodh, openstack-watcher
    affected: workaround, no fix available “Fix deferred”
  • Red Hat OpenStack Platform 13 (Queens) python-aodh, python-aodh-tests, openstack-aodh-api, openstack-aodh-common, openstack-aodh-compat, openstack-aodh-expirer, +3 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 mo ago

Exploit prediction

0.54% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 8.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:H/SA:L
CNA 4.0 8.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • OpenStack Aodh

Classification

Weakness
  • CWE-688 Function Call With Incorrect Variable or Reference as Argument

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.