OSSA-2026-036: Aodh cross-project alarm enumeration and Watcher webhook authorization bypass

Date:

August 19, 2026

CVE:

CVE-2026-76878

Affects

  • Aodh: >=10.0.0 <20.0.1, ==21.0.0, ==22.0.0

  • Watcher: >=4.0.0 <14.1.2, >=15.0.0 <15.1.2, >=16.0.0 <16.0.2

Description

Chen YuXiang of the Institute of Computing Technology, Chinese Academy of Sciences reported that OpenStack Aodh does not enforce project scope on the alarm listing API when the all_projects query parameter is supplied with a false value. A non-admin user holding only the reader role can list alarms belonging to other projects, optionally targeting a specific project, exposing alarm metadata such as webhook action URLs, signal endpoints, and project identifiers. All Aodh deployments are affected.

The same reporter found that OpenStack Watcher does not apply authorization to its webhook trigger endpoint. Any authenticated user who learns an audit’s webhook URL, for example from the Aodh alarm metadata leaked above, can start an EVENT audit and its associated action plan regardless of their own project or role. All Watcher deployments are affected.

Errata

MITRE assigned CVE-2026-76878 after initial publication.

Patches

Credits

  • Chen YuXiang from Institute of Computing Technology, Chinese Academy of Sciences

References

OSSA History

  • 2026-08-20 - Errata 1

  • 2026-08-19 - Original Version