Summary
Chen YuXiang discovered that OpenStack Aodh did not correctly enforce
project scoping in its alarm list API and that the OpenStack Watcher
webhook trigger endpoint did not apply authorization. An attacker could
possibly use this issue to access sensitive alarm metadata or trigger
unauthorized action plans.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | aodh | 1:14.1.0-0ubuntu1.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | aodh | 1:18.0.0-0ubuntu1.1 |
| Ubuntu · 26.04 LTS 26.04:LTS | aodh | 1:22.0.0-0ubuntu1.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | aodh | 10.0.0-0ubuntu0.20.04.1+esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | watcher | 1:4.0.0-0ubuntu0.20.04.1+esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | watcher | 2:8.0.0-0ubuntu1.2+esm1 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | watcher | 2:12.0.0-0ubuntu1.3+esm1 |
| Ubuntu · Pro 26.04 LTS Pro:26.04:LTS | watcher | 2:16.0.0-0ubuntu1+esm1 |
Vulnerabilities 1
-
High 8.4
In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the all_projects query parameter is s…
References
-
report
https://ubuntu.com/security/CVE-2026-76878