Bug 2517803 (CVE-2026-76878)

Summary:	CVE-2026-76878 aodh: python-watcher: aodh / python-watcher: cross-project alarm enumeration and webhook missing authorization
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	eglynn, jjoyce, jpretori, jschluet, lhh, mburns, mgarciac, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in OpenStack Aodh and Watcher. In Aodh, the alarm listing API does not correctly enforce project scope when the all_projects query parameter is present with a false value. A non-admin authenticated user can list alarms belonging to other projects, potentially exposing alarm configurations, webhook URLs, and project identifiers. In Watcher, the webhook trigger endpoint does not enforce oslo.policy authorization, allowing any authenticated user who learns an audit webhook URL to trigger EVENT audits and associated action plans regardless of project or role.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-08-19

Description OSIDB Bzimport 2026-08-18 12:12:03 UTC

OpenStack Aodh (Telemetry Alarming) contains an incorrect authorization flaw in the alarm listing API endpoint. In AlarmsController.get_all() in aodh/api/controllers/v2/alarms.py, when the all_projects query parameter is present with a value of false, the code enters the 'if all_projects in keys' branch and removes all_projects from the filter keys, but skips both the admin-only policy enforcement and the else branch that normally adds project_id scoping. This results in a database query with no project_id filter, returning alarms from all projects.

A non-admin user with project_reader role can enumerate all alarms across all projects by setting all_projects=false, and can target a specific foreign project by combining this with a project_id filter. Leaked data includes alarm names, types, configurations, project/user IDs, and action URLs. Trust IDs are scrubbed from trust+* URLs by from_db_model_scrubbed, but base webhook URLs and plain http/https action URLs are returned unmodified.

The correct behavior is demonstrated by the metrics controller (aodh/api/controllers/v2/metrics.py), which applies project_id filtering in both the True and False branches.

Affected versions per upstream: >=10.0.0 <20.0.1, ==21.0.0, ==22.0.0.
Fix: proposed patches attached to the PSIRT ticket; not yet publicly released.
Reporter: Chen YuXiang, Institute of Computing Technology, Chinese Academy of Sciences.
Upstream bug: LP#2161276.
PSIRT ticket: PSIRTSUPT-21526.