CVE catalog

CVE-2026-76878

In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the all_projects query parameter is set to false. The API checks for the presence of the all_projects key rather than

[CVE catalog]

Severity: High · CVSS 8.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published: Aug 19, 2026, 3:00:00 PM UTC
Updated: Aug 19, 2026, 10:17:28 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.54% · Oct 25, 2026

In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the all_projects query parameter is set to false. The API checks for the presence of the all_projects key rather than its value; a true value enforces the administrator-only policy, but a false value removes the key and skips the branch that normally restricts results to the caller's project. A non-admin user with the reader role can list alarms from all projects, exposing alarm actions containing trust webhook URLs, Heat signal endpoints, project IDs, and user IDs. The parameter can also be combined with a foreign project_id to target a specific project's alarms. A related concern is that OpenStack Watcher does not apply authorization to its webhook trigger endpoint. Any authenticated user who learns an audit's webhook URL, for example from this leaked Aodh alarm metadata, can start an EVENT audit and its associated action plan regardless of their own project or role. The webhook endpoint has lacked policy enforcement since its introduction in the Ussuri release (Watcher 4.0.0).

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	aodh	sid	`23.0.0-2`	fixed
Debian	aodh	forky	`22.0.1-1`	fixed
Debian	aodh	trixie	`20.0.0-2`	vulnerable
Debian	aodh	bookworm	`15.0.0-3`	vulnerable
Debian	watcher	sid	`17.0.0-2`	fixed
Debian	watcher	forky	`17.0.0-2`	fixed
Debian	watcher	trixie	`14.0.0-1+deb13u1`	vulnerable
Debian	watcher	bookworm	`9.0.0-2`	vulnerable
Ubuntu	aodh	noble	`1:18.0.0-0ubuntu1.1`	fixed
Ubuntu	watcher	noble	`2:12.0.0-0ubuntu1.3+esm1`	fixed
Ubuntu	aodh-api	noble	`1:18.0.0-0ubuntu1.1`	fixed
Ubuntu	aodh-common	noble	`1:18.0.0-0ubuntu1.1`	fixed
Ubuntu	aodh-doc	noble	`1:18.0.0-0ubuntu1.1`	fixed
Ubuntu	aodh-evaluator	noble	`1:18.0.0-0ubuntu1.1`	fixed
Ubuntu	aodh-expirer	noble	`1:18.0.0-0ubuntu1.1`	fixed
Ubuntu	aodh-listener	noble	`1:18.0.0-0ubuntu1.1`	fixed
Ubuntu	aodh-notifier	noble	`1:18.0.0-0ubuntu1.1`	fixed
Ubuntu	python3-aodh	noble	`1:18.0.0-0ubuntu1.1`	fixed
Ubuntu	python3-watcher	noble	`2:12.0.0-0ubuntu1.3+esm1`	fixed
Ubuntu	watcher-api	noble	`2:12.0.0-0ubuntu1.3+esm1`	fixed
Ubuntu	watcher-applier	noble	`2:12.0.0-0ubuntu1.3+esm1`	fixed
Ubuntu	watcher-common	noble	`2:12.0.0-0ubuntu1.3+esm1`	fixed
Ubuntu	watcher-decision-engine	noble	`2:12.0.0-0ubuntu1.3+esm1`	fixed
Ubuntu	watcher-doc	noble	`2:12.0.0-0ubuntu1.3+esm1`	fixed
Ubuntu	aodh	pro	`9.0.0-0ubuntu1`	vulnerable
Ubuntu	aodh	pro	`10.0.0~b1~git2019121610.b18d0bae-0ubuntu1`	vulnerable
Ubuntu	aodh	pro	`10.0.0~b2~git2020020508.83ef3a81-0ubuntu1`	vulnerable
Ubuntu	aodh	pro	`10.0.0~b3~git2020032411.ed802044-0ubuntu1`	vulnerable
Ubuntu	aodh	pro	`10.0.0~b3~git2020041012.6ae7f90a-0ubuntu1`	vulnerable
Ubuntu	aodh	pro	`10.0.0-0ubuntu0.20.04.1`	vulnerable
Ubuntu	aodh	pro	`10.0.0-0ubuntu0.20.04.1+esm1`	fixed
Ubuntu	watcher	pro	`2:15.0.0-0ubuntu1`	vulnerable
Ubuntu	watcher	pro	`2:15.0.0+git20260121.89.f6aac33e-0ubuntu1`	vulnerable
Ubuntu	watcher	pro	`2:16.0.0~rc1-0ubuntu2`	vulnerable
Ubuntu	watcher	pro	`2:16.0.0-0ubuntu1`	vulnerable
Ubuntu	watcher	pro	`2:16.0.0-0ubuntu1+esm1`	fixed
Ubuntu	aodh	22.04	`1:13.0.0-0ubuntu1`	vulnerable
Ubuntu	aodh	22.04	`1:13.0.0+git2022011215.8ac7c65c-0ubuntu1`	vulnerable
Ubuntu	aodh	22.04	`1:14.0.0~rc1-0ubuntu1`	vulnerable
Ubuntu	aodh	22.04	`1:14.0.0~rc1-0ubuntu2`	vulnerable
Ubuntu	aodh	22.04	`1:14.0.0-0ubuntu1`	vulnerable
Ubuntu	aodh	22.04	`1:14.0.0-0ubuntu1.1`	vulnerable
Ubuntu	aodh	22.04	`1:14.1.0-0ubuntu1`	vulnerable
Ubuntu	aodh	22.04	`1:14.1.0-0ubuntu1.1`	fixed
Ubuntu	aodh	24.04	`1:17.0.0-0ubuntu2`	vulnerable
Ubuntu	aodh	24.04	`1:17.0.0+git2024011915.3d49da3c-0ubuntu1`	vulnerable
Ubuntu	aodh	24.04	`1:17.0.0+git2024030809.64e0f7c8-0ubuntu1`	vulnerable
Ubuntu	aodh	24.04	`1:18.0.0~rc1-0ubuntu1`	vulnerable
Ubuntu	aodh	24.04	`1:18.0.0-0ubuntu1`	vulnerable
Ubuntu	aodh	24.04	`1:18.0.0-0ubuntu1.1`	fixed
Ubuntu	aodh	26.04	`1:21.0.0-0ubuntu1`	vulnerable
Ubuntu	aodh	26.04	`1:21.0.0-0ubuntu2`	vulnerable
Ubuntu	aodh	26.04	`1:21.0.0+git20260218.38.d7e8427e-0ubuntu1`	vulnerable
Ubuntu	aodh	26.04	`1:22.0.0~rc1-0ubuntu1`	vulnerable
Ubuntu	aodh	26.04	`1:22.0.0-0ubuntu1`	vulnerable
Ubuntu	aodh	26.04	`1:22.0.0-0ubuntu1.1`	fixed
Ubuntu	aodh	pro	`9.0.0-0ubuntu1`	vulnerable
Ubuntu	aodh	pro	`10.0.0~b1~git2019121610.b18d0bae-0ubuntu1`	vulnerable
Ubuntu	aodh	pro	`10.0.0~b2~git2020020508.83ef3a81-0ubuntu1`	vulnerable
Ubuntu	aodh	pro	`10.0.0~b3~git2020032411.ed802044-0ubuntu1`	vulnerable
Ubuntu	aodh	pro	`10.0.0~b3~git2020041012.6ae7f90a-0ubuntu1`	vulnerable
Ubuntu	aodh	pro	`10.0.0-0ubuntu0.20.04.1`	vulnerable
Ubuntu	aodh	pro	`10.0.0-0ubuntu0.20.04.1+esm1`	fixed
Ubuntu	watcher	pro	`2:15.0.0-0ubuntu1`	vulnerable
Ubuntu	watcher	pro	`2:15.0.0+git20260121.89.f6aac33e-0ubuntu1`	vulnerable
Ubuntu	watcher	pro	`2:16.0.0~rc1-0ubuntu2`	vulnerable
Ubuntu	watcher	pro	`2:16.0.0-0ubuntu1`	vulnerable
Ubuntu	watcher	pro	`2:16.0.0-0ubuntu1+esm1`	fixed
Ubuntu	aodh	22.04	`1:13.0.0-0ubuntu1`	vulnerable
Ubuntu	aodh	22.04	`1:13.0.0+git2022011215.8ac7c65c-0ubuntu1`	vulnerable
Ubuntu	aodh	22.04	`1:14.0.0~rc1-0ubuntu1`	vulnerable
Ubuntu	aodh	22.04	`1:14.0.0~rc1-0ubuntu2`	vulnerable
Ubuntu	aodh	22.04	`1:14.0.0-0ubuntu1`	vulnerable
Ubuntu	aodh	22.04	`1:14.0.0-0ubuntu1.1`	vulnerable
Ubuntu	aodh	22.04	`1:14.1.0-0ubuntu1`	vulnerable
Ubuntu	aodh	22.04	`1:14.1.0-0ubuntu1.1`	fixed
Ubuntu	aodh	24.04	`1:17.0.0-0ubuntu2`	vulnerable
Ubuntu	aodh	24.04	`1:17.0.0+git2024011915.3d49da3c-0ubuntu1`	vulnerable
Ubuntu	aodh	24.04	`1:17.0.0+git2024030809.64e0f7c8-0ubuntu1`	vulnerable
Ubuntu	aodh	24.04	`1:18.0.0~rc1-0ubuntu1`	vulnerable
Ubuntu	aodh	24.04	`1:18.0.0-0ubuntu1`	vulnerable
Ubuntu	aodh	24.04	`1:18.0.0-0ubuntu1.1`	fixed
Ubuntu	aodh	26.04	`1:21.0.0-0ubuntu1`	vulnerable
Ubuntu	aodh	26.04	`1:21.0.0-0ubuntu2`	vulnerable
Ubuntu	aodh	26.04	`1:21.0.0+git20260218.38.d7e8427e-0ubuntu1`	vulnerable
Ubuntu	aodh	26.04	`1:22.0.0~rc1-0ubuntu1`	vulnerable
Ubuntu	aodh	26.04	`1:22.0.0-0ubuntu1`	vulnerable
Ubuntu	aodh	26.04	`1:22.0.0-0ubuntu1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	aodh	source	sid	`22.0.0-3`	not yet assigned	Not reported	[1144879]
Debian	aodh	source	forky	`22.0.0-3`	not yet assigned	Not reported	[1144879]
Debian	aodh	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1144879]
Debian	aodh	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1144879]
Debian	watcher	source	sid	`16.0.0-5`	not yet assigned	Not reported	[1144880]
Debian	watcher	source	forky	`16.0.0-5`	not yet assigned	Not reported	[1144880]
Debian	watcher	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1144880]
Debian	watcher	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1144880]
Ubuntu	aodh	deb	noble	`1:18.0.0-0ubuntu1.1`	Not reported	Not reported	Not reported
Ubuntu	watcher	deb	noble	`2:12.0.0-0ubuntu1.3+esm1`	Not reported	Not reported	Not reported
Ubuntu	aodh-api	deb	noble	`1:18.0.0-0ubuntu1.1`	Not reported	Not reported	Not reported
Ubuntu	aodh-common	deb	noble	`1:18.0.0-0ubuntu1.1`	Not reported	Not reported	Not reported
Ubuntu	aodh-doc	deb	noble	`1:18.0.0-0ubuntu1.1`	Not reported	Not reported	Not reported
Ubuntu	aodh-evaluator	deb	noble	`1:18.0.0-0ubuntu1.1`	Not reported	Not reported	Not reported
Ubuntu	aodh-expirer	deb	noble	`1:18.0.0-0ubuntu1.1`	Not reported	Not reported	Not reported
Ubuntu	aodh-listener	deb	noble	`1:18.0.0-0ubuntu1.1`	Not reported	Not reported	Not reported
Ubuntu	aodh-notifier	deb	noble	`1:18.0.0-0ubuntu1.1`	Not reported	Not reported	Not reported
Ubuntu	python3-aodh	deb	noble	`1:18.0.0-0ubuntu1.1`	Not reported	Not reported	Not reported
Ubuntu	python3-watcher	deb	noble	`2:12.0.0-0ubuntu1.3+esm1`	Not reported	Not reported	Not reported
Ubuntu	watcher-api	deb	noble	`2:12.0.0-0ubuntu1.3+esm1`	Not reported	Not reported	Not reported
Ubuntu	watcher-applier	deb	noble	`2:12.0.0-0ubuntu1.3+esm1`	Not reported	Not reported	Not reported
Ubuntu	watcher-common	deb	noble	`2:12.0.0-0ubuntu1.3+esm1`	Not reported	Not reported	Not reported
Ubuntu	watcher-decision-engine	deb	noble	`2:12.0.0-0ubuntu1.3+esm1`	Not reported	Not reported	Not reported
Ubuntu	watcher-doc	deb	noble	`2:12.0.0-0ubuntu1.3+esm1`	Not reported	Not reported	Not reported
Ubuntu	aodh	deb	pro	`10.0.0-0ubuntu0.20.04.1+esm1`	Not reported	USN-8870-1	Not reported
Ubuntu	watcher	deb	pro	`2:16.0.0-0ubuntu1+esm1`	Not reported	USN-8870-1	Not reported
Ubuntu	aodh	deb	22.04	`1:14.1.0-0ubuntu1.1`	Not reported	USN-8870-1	Not reported
Ubuntu	aodh	deb	24.04	`1:18.0.0-0ubuntu1.1`	Not reported	USN-8870-1	Not reported
Ubuntu	aodh	deb	26.04	`1:22.0.0-0ubuntu1.1`	Not reported	USN-8870-1	Not reported
Ubuntu	aodh	deb	pro	`10.0.0-0ubuntu0.20.04.1+esm1`	Not reported	UBUNTU-CVE-2026-76878	Not reported
Ubuntu	watcher	deb	pro	`2:16.0.0-0ubuntu1+esm1`	Not reported	UBUNTU-CVE-2026-76878	Not reported
Ubuntu	aodh	deb	22.04	`1:14.1.0-0ubuntu1.1`	Not reported	UBUNTU-CVE-2026-76878	Not reported
Ubuntu	aodh	deb	24.04	`1:18.0.0-0ubuntu1.1`	Not reported	UBUNTU-CVE-2026-76878	Not reported
Ubuntu	aodh	deb	26.04	`1:22.0.0-0ubuntu1.1`	Not reported	UBUNTU-CVE-2026-76878	Not reported

[Debian bug #1144879][Debian bug #1144880]

Notes

[trixie] aodh: Minor issue [bookworm] aodh: Minor issue [trixie] watcher: Minor issue [bookworm] watcher: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[aodh-api]Affected
Source package: [aodh]
Details (2)
- 15.0.0-3 · all · bookworm
  Affected
  nvd · aodh · debian · bookworm; nvd · aodh · debian · 12
- 15.0.0-3 · all · bookworm
  Affected
  nvd · aodh · debian · bookworm; nvd · aodh · debian · 12
[aodh-common]Affected
Source package: [aodh]
Details (2)
- 15.0.0-3 · all · bookworm
  Affected
  nvd · aodh · debian · bookworm; nvd · aodh · debian · 12
- 15.0.0-3 · all · bookworm
  Affected
  nvd · aodh · debian · bookworm; nvd · aodh · debian · 12
[aodh-doc]Affected
Source package: [aodh]
Details (2)
- 15.0.0-3 · all · bookworm
  Affected
  nvd · aodh · debian · bookworm; nvd · aodh · debian · 12
- 15.0.0-3 · all · bookworm
  Affected
  nvd · aodh · debian · bookworm; nvd · aodh · debian · 12
[aodh-evaluator]Affected
Source package: [aodh]
Details (2)
- 15.0.0-3 · all · bookworm
  Affected
  nvd · aodh · debian · bookworm; nvd · aodh · debian · 12
- 15.0.0-3 · all · bookworm
  Affected
  nvd · aodh · debian · bookworm; nvd · aodh · debian · 12
[aodh-expirer]Affected
Source package: [aodh]
Details (2)
- 15.0.0-3 · all · bookworm
  Affected
  nvd · aodh · debian · bookworm; nvd · aodh · debian · 12
- 15.0.0-3 · all · bookworm
  Affected
  nvd · aodh · debian · bookworm; nvd · aodh · debian · 12
[aodh-listener]Affected
Source package: [aodh]
Details (2)
- 15.0.0-3 · all · bookworm
  Affected
  nvd · aodh · debian · bookworm; nvd · aodh · debian · 12
- 15.0.0-3 · all · bookworm
  Affected
  nvd · aodh · debian · bookworm; nvd · aodh · debian · 12
[aodh-notifier]Affected
Source package: [aodh]
Details (2)
- 15.0.0-3 · all · bookworm
  Affected
  nvd · aodh · debian · bookworm; nvd · aodh · debian · 12
- 15.0.0-3 · all · bookworm
  Affected
  nvd · aodh · debian · bookworm; nvd · aodh · debian · 12
[python3-aodh]Affected
Source package: [aodh]
Details (2)
- 15.0.0-3 · all · bookworm
  Affected
  nvd · aodh · debian · bookworm; nvd · aodh · debian · 12
- 15.0.0-3 · all · bookworm
  Affected
  nvd · aodh · debian · bookworm; nvd · aodh · debian · 12
[python3-watcher]Affected
Source package: [watcher]
Details (2)
- 9.0.0-2 · all · bookworm
  Affected
  nvd · watcher · debian · bookworm; nvd · watcher · debian · 12
- 9.0.0-2 · all · bookworm
  Affected
  nvd · watcher · debian · bookworm; nvd · watcher · debian · 12
[watcher-api]Affected
Source package: [watcher]
Details (2)
- 9.0.0-2 · all · bookworm
  Affected
  nvd · watcher · debian · bookworm; nvd · watcher · debian · 12
- 9.0.0-2 · all · bookworm
  Affected
  nvd · watcher · debian · bookworm; nvd · watcher · debian · 12
[watcher-applier]Affected
Source package: [watcher]
Details (2)
- 9.0.0-2 · all · bookworm
  Affected
  nvd · watcher · debian · bookworm; nvd · watcher · debian · 12
- 9.0.0-2 · all · bookworm
  Affected
  nvd · watcher · debian · bookworm; nvd · watcher · debian · 12
[watcher-common]Affected
Source package: [watcher]
Details (2)
- 9.0.0-2 · all · bookworm
  Affected
  nvd · watcher · debian · bookworm; nvd · watcher · debian · 12
- 9.0.0-2 · all · bookworm
  Affected
  nvd · watcher · debian · bookworm; nvd · watcher · debian · 12
[watcher-decision-engine]Affected
Source package: [watcher]
Details (2)
- 9.0.0-2 · all · bookworm
  Affected
  nvd · watcher · debian · bookworm; nvd · watcher · debian · 12
- 9.0.0-2 · all · bookworm
  Affected
  nvd · watcher · debian · bookworm; nvd · watcher · debian · 12
[watcher-doc]Affected
Source package: [watcher]
Details (2)
- 9.0.0-2 · all · bookworm
  Affected
  nvd · watcher · debian · bookworm; nvd · watcher · debian · 12
- 9.0.0-2 · all · bookworm
  Affected
  nvd · watcher · debian · bookworm; nvd · watcher · debian · 12

[Debian 13 (Trixie)]

[aodh-api]Affected
Source package: [aodh]
Details (2)
- 20.0.0-2 · all · trixie
  Affected
  nvd · aodh · debian · 13
- 20.0.0-2 · all · trixie
  Affected
  nvd · aodh · debian · 13
[aodh-common]Affected
Source package: [aodh]
Details (2)
- 20.0.0-2 · all · trixie
  Affected
  nvd · aodh · debian · 13
- 20.0.0-2 · all · trixie
  Affected
  nvd · aodh · debian · 13
[aodh-doc]Affected
Source package: [aodh]
Details (2)
- 20.0.0-2 · all · trixie
  Affected
  nvd · aodh · debian · 13
- 20.0.0-2 · all · trixie
  Affected
  nvd · aodh · debian · 13
[aodh-evaluator]Affected
Source package: [aodh]
Details (2)
- 20.0.0-2 · all · trixie
  Affected
  nvd · aodh · debian · 13
- 20.0.0-2 · all · trixie
  Affected
  nvd · aodh · debian · 13
[aodh-expirer]Affected
Source package: [aodh]
Details (2)
- 20.0.0-2 · all · trixie
  Affected
  nvd · aodh · debian · 13
- 20.0.0-2 · all · trixie
  Affected
  nvd · aodh · debian · 13
[aodh-listener]Affected
Source package: [aodh]
Details (2)
- 20.0.0-2 · all · trixie
  Affected
  nvd · aodh · debian · 13
- 20.0.0-2 · all · trixie
  Affected
  nvd · aodh · debian · 13

Next results

Observed: Oct 23, 2026, 9:38:41 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [Ubuntu Security Notices (USN)]