CVE-2026-76878 Overview
CVE-2026-76878 is an authorization bypass in OpenStack Aodh prior to version 22.0.1. The alarm list API checks for the presence of the all_projects query parameter rather than its value. Setting all_projects=false removes the key and skips the branch that restricts results to the caller's project. A non-admin user with the reader role can enumerate alarms across every project in the deployment.
Critical Impact
Leaked alarm metadata exposes trust webhook URLs, Heat signal endpoints, project IDs, and user IDs. Combined with an unauthenticated OpenStack Watcher webhook trigger endpoint, any authenticated user can start EVENT audits and action plans in foreign projects.
Affected Products
- OpenStack Aodh before 22.0.1
- OpenStack Watcher 4.0.0 and later (webhook trigger endpoint lacks policy enforcement since the Ussuri release)
- OpenStack deployments exposing Aodh alarm listing to reader-role users
Discovery Timeline
- 2026-08-19 - CVE-2026-76878 published to the National Vulnerability Database
- 2026-08-19 - OpenStack Security Advisory OSSA-2026-036 released alongside disclosure on the oss-security mailing list
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-76878
Vulnerability Analysis
The vulnerability stems from an incorrect logic check in Aodh's alarm list API. The endpoint tests whether the all_projects query parameter key exists in the request rather than evaluating its boolean value. When a client submits all_projects=true, Aodh enforces the administrator-only policy as expected. When a client submits all_projects=false, the request handling code removes the key from the parameter dictionary and bypasses the branch that scopes results to the caller's project.
This behavior is classified as CWE-688 (Function Call With Incorrect Variable or Reference as Argument). A reader-role user in any project can list alarms across the entire deployment. The parameter can be combined with a foreign project_id value to target a specific victim project.
Alarm records include action definitions containing trust-scoped webhook URLs, Heat signal endpoints, project identifiers, and user identifiers. Attackers use this metadata to pivot into related services. OpenStack Watcher compounds the issue because its webhook trigger endpoint has never enforced authorization policy since Watcher 4.0.0. An authenticated user who obtains a Watcher audit's webhook URL can invoke it to start an EVENT audit and its associated action plan.
Root Cause
The Aodh alarm list handler evaluates parameter presence with a truthy key check instead of parsing the parameter value as a boolean. The false path silently strips the scoping predicate that constrains query results to the requesting project.
Attack Vector
Exploitation requires an authenticated OpenStack account with the reader role on any project. The attacker issues a GET request to the Aodh alarm list endpoint with all_projects=false, optionally combined with a target project_id. No user interaction is required. Attackers chain the disclosed webhook URLs against Watcher to trigger unauthorized audit workflows in foreign projects.
For technical details, see the OpenStack Security Advisory OSSA-2026-036 and Launchpad Bug #2161276.
Detection Methods for CVE-2026-76878
Indicators of Compromise
- Aodh API access logs containing GET requests to /v2/alarms with the all_projects=false query parameter from non-admin service accounts
- Aodh queries that include an explicit project_id filter that does not match the requesting user's project
- Watcher API calls to the audit webhook trigger endpoint originating from accounts that do not own the referenced audit
- Unexpected EVENT audit executions or action plan activations in project audit logs
Detection Strategies
- Parse Aodh API access logs for the literal string all_projects and correlate the requester's Keystone role and project scope against the returned alarm project IDs
- Enable Keystone audit middleware and alert when reader-role tokens retrieve alarm records outside their assigned project
- Baseline normal Watcher webhook invocation patterns and flag out-of-band triggers that lack a corresponding scheduled audit
Monitoring Recommendations
- Forward Aodh, Watcher, and Keystone logs into a centralized analytics platform with role-aware enrichment
- Alert on any non-admin token that receives alarm records from more than one project ID in a single response
- Review historical logs for all_projects=false requests predating the patch to identify prior exposure
How to Mitigate CVE-2026-76878
Immediate Actions Required
- Upgrade OpenStack Aodh to version 22.0.1 or later on all controller nodes running the alarm API
- Apply the Watcher patches referenced in OSSA-2026-036 to enforce policy on the webhook trigger endpoint
- Rotate any trust webhook URLs, Heat signal secrets, and long-lived tokens that may have been exposed in leaked alarm metadata
- Audit existing alarms across projects for unauthorized modifications or actions added by non-owning users
Patch Information
The OpenStack Aodh project addresses the alarm list scoping flaw in release 22.0.1. Related Watcher fixes for the webhook policy gap are coordinated under the same advisory. Refer to the OpenStack Announce Thread for consolidated version guidance and to Launchpad Bug #2161771 for the Watcher tracking record.
Workarounds
- Restrict the Aodh alarm list endpoint at the API gateway or reverse proxy so that requests containing all_projects are only permitted from admin roles
- Override the Aodh policy file to deny the telemetry:get_alarms action for the reader role until upgrades complete
- Block external access to the Watcher webhook trigger endpoint and require network-layer authentication until the policy fix is deployed
- Regenerate trust IDs used by Aodh alarm actions to invalidate any URLs previously exposed through the API
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
