CVE-2026-76878

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-76878", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-08-19T22:04:55.203Z", "datePublished": "2026-08-19T22:04:56.091Z", "dateUpdated": "2026-11-12T05:05:05.824Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Aodh", "repo": "https://opendev.org/openstack/aodh", "vendor": "OpenStack", "versions": [{"lessThan": "20.0.1", "status": "affected", "version": "10.0.0", "versionType": "semver"}, {"lessThan": "21.0.1", "status": "affected", "version": "21.0.0", "versionType": "semver"}, {"lessThan": "22.0.1", "status": "affected", "version": "22.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the all_projects query parameter is set to false. The API checks for the presence of the all_projects key rather than its value; a true value enforces the administrator-only policy, but a false value removes the key and skips the branch that normally restricts results to the caller's project. A non-admin user with the reader role can list alarms from all projects, exposing alarm actions containing trust webhook URLs, Heat signal endpoints, project IDs, and user IDs. The parameter can also be combined with a foreign project_id to target a specific project's alarms. A related concern is that OpenStack Watcher does not apply authorization to its webhook trigger endpoint. Any authenticated user who learns an audit's webhook URL, for example from this leaked Aodh alarm metadata, can start an EVENT audit and its associated action plan regardless of their own project or role. The webhook endpoint has lacked policy enforcement since its introduction in the Ussuri release (Watcher 4.0.0)."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.4, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:H/SA:L", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-688", "description": "CWE-688 Function Call With Incorrect Variable or Reference as Argument", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-08-19T22:04:56.091Z"}, "references": [{"tags": ["issue-tracking"], "url": "https://launchpad.net/bugs/2161276"}, {"tags": ["issue-tracking"], "url": "https://launchpad.net/bugs/2161771"}, {"tags": ["vendor-advisory"], "url": "https://security.openstack.org/ossa/OSSA-2026-036.html"}, {"tags": ["vendor-advisory", "mailing-list"], "url": "https://lists.openstack.org/archives/list/openstack-announce@lists.openstack.org/thread/O6PKAUNMNZP6FRHLUUGBYELCRBEPB52B/"}, {"url": "https://www.openwall.com/lists/oss-security/2026/08/19/5"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-76878", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-20T15:08:58.058420Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T15:26:30.825Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/08/20/21"}, {"url": "https://lists.debian.org/debian-lts-announce/2026/11/msg00019.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2026/11/msg00020.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-11-12T05:05:05.824Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/08/20/21"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-08-21T01:30:49.666Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-76878", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-20T15:08:58.058420Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T15:23:44.008Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.4, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:H/SA:L", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://opendev.org/openstack/aodh", "vendor": "OpenStack", "product": "Aodh", "versions": [{"status": "affected", "version": "10.0.0", "lessThan": "20.0.1", "versionType": "semver"}, {"status": "affected", "version": "21.0.0", "lessThan": "21.0.1", "versionType": "semver"}, {"status": "affected", "version": "22.0.0", "lessThan": "22.0.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://launchpad.net/bugs/2161276", "tags": ["issue-tracking"]}, {"url": "https://launchpad.net/bugs/2161771", "tags": ["issue-tracking"]}, {"url": "https://security.openstack.org/ossa/OSSA-2026-036.html", "tags": ["vendor-advisory"]}, {"url": "https://lists.openstack.org/archives/list/openstack-announce@lists.openstack.org/thread/O6PKAUNMNZP6FRHLUUGBYELCRBEPB52B/", "tags": ["vendor-advisory", "mailing-list"]}, {"url": "https://www.openwall.com/lists/oss-security/2026/08/19/5"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the all_projects query parameter is set to false. The API checks for the presence of the all_projects key rather than its value; a true value enforces the administrator-only policy, but a false value removes the key and skips the branch that normally restricts results to the caller's project. A non-admin user with the reader role can list alarms from all projects, exposing alarm actions containing trust webhook URLs, Heat signal endpoints, project IDs, and user IDs. The parameter can also be combined with a foreign project_id to target a specific project's alarms. A related concern is that OpenStack Watcher does not apply authorization to its webhook trigger endpoint. Any authenticated user who learns an audit's webhook URL, for example from this leaked Aodh alarm metadata, can start an EVENT audit and its associated action plan regardless of their own project or role. The webhook endpoint has lacked policy enforcement since its introduction in the Ussuri release (Watcher 4.0.0)."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-688", "description": "CWE-688 Function Call With Incorrect Variable or Reference as Argument"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-08-19T22:04:56.091Z"}}}, "cveMetadata": {"cveId": "CVE-2026-76878", "state": "PUBLISHED", "dateUpdated": "2026-08-21T01:30:49.666Z", "dateReserved": "2026-08-19T22:04:55.203Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-08-19T22:04:56.091Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Aodh", "repo": "https://opendev.org/openstack/aodh", "vendor": "OpenStack", "versions": [{"lessThan": "20.0.1", "status": "affected", "version": "10.0.0", "versionType": "semver"}, {"lessThan": "21.0.1", "status": "affected", "version": "21.0.0", "versionType": "semver"}, {"lessThan": "22.0.1", "status": "affected", "version": "22.0.0", "versionType": "semver"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the all_projects query parameter is set to false. The API checks for the presence of the all_projects key rather than its value; a true value enforces the administrator-only policy, but a false value removes the key and skips the branch that normally restricts results to the caller's project. A non-admin user with the reader role can list alarms from all projects, exposing alarm actions containing trust webhook URLs, Heat signal endpoints, project IDs, and user IDs. The parameter can also be combined with a foreign project_id to target a specific project's alarms. A related concern is that OpenStack Watcher does not apply authorization to its webhook trigger endpoint. Any authenticated user who learns an audit's webhook URL, for example from this leaked Aodh alarm metadata, can start an EVENT audit and its associated action plan regardless of their own project or role. The webhook endpoint has lacked policy enforcement since its introduction in the Ussuri release (Watcher 4.0.0)."}], "id": "CVE-2026-76878", "lastModified": "2026-11-12T06:17:15.073", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cve@mitre.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-76878", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-20T15:08:58.058420Z", "version": "2.0.3"}}]}, "published": "2026-08-19T22:17:28.310", "references": [{"source": "cve@mitre.org", "url": "https://launchpad.net/bugs/2161276"}, {"source": "cve@mitre.org", "url": "https://launchpad.net/bugs/2161771"}, {"source": "cve@mitre.org", "url": "https://lists.openstack.org/archives/list/openstack-announce@lists.openstack.org/thread/O6PKAUNMNZP6FRHLUUGBYELCRBEPB52B/"}, {"source": "cve@mitre.org", "url": "https://security.openstack.org/ossa/OSSA-2026-036.html"}, {"source": "cve@mitre.org", "url": "https://www.openwall.com/lists/oss-security/2026/08/19/5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/08/20/21"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2026/11/msg00019.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2026/11/msg00020.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-688"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{"acknowledgement": "Upstream acknowledges Chen YuXiang (Institute of Computing Technology, Chinese Academy of Sciences) as the original reporter.", "bugzilla": {"description": "aodh: python-watcher: aodh / python-watcher: cross-project alarm enumeration and webhook missing authorization", "id": "2517803", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517803"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "status": "draft"}, "cwe": "CWE-863", "details": ["A flaw was found in OpenStack Aodh and Watcher. In Aodh, the alarm listing API does not correctly enforce project scope when the all_projects query parameter is present with a false value. A non-admin authenticated user can list alarms belonging to other projects, potentially exposing alarm configurations, webhook URLs, and project identifiers. In Watcher, the webhook trigger endpoint does not enforce oslo.policy authorization, allowing any authenticated user who learns an audit webhook URL to trigger EVENT audits and associated action plans regardless of project or role."], "mitigation": {"lang": "en:us", "value": "Restrict network access to the Aodh API (default port 8042) and the Watcher API (default port 9322) to trusted administrative networks. Review Keystone role assignments to minimize users with project_reader or higher that can reach the Aodh API. The Watcher webhook path cannot be isolated from the main REST API. Keep enable_webhooks_auth=True (the default). Do not create or use event-based audits."}, "name": "CVE-2026-76878", "package_state": [{"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Not affected", "package_name": "openstack-aodh", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Fix deferred", "package_name": "openstack-aodh", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Out of support scope", "package_name": "rhosp-rhel8/openstack-aodh-api", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Out of support scope", "package_name": "rhosp-rhel8/openstack-aodh-base", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Out of support scope", "package_name": "rhosp-rhel8/openstack-aodh-evaluator", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Out of support scope", "package_name": "rhosp-rhel8/openstack-aodh-listener", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Out of support scope", "package_name": "rhosp-rhel8/openstack-aodh-notifier", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Fix deferred", "package_name": "openstack-aodh", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Fix deferred", "package_name": "openstack-aodh", "product_name": "Red Hat OpenStack Platform 18.0"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Fix deferred", "package_name": "openstack-watcher", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2026-08-19T15:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-76878\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-76878\nhttps://launchpad.net/bugs/2161276\nhttps://launchpad.net/bugs/2161771\nhttps://security.openstack.org/ossa/OSSA-2026-036.html\nhttps://www.openwall.com/lists/oss-security/2026/08/19/5"], "statement": "Red Hat OpenStack Platform ships OpenStack Aodh as openstack-aodh in RHOSP 16.2, 17.1, and 18.0. RHOSP 16.2 is affected. That release does not receive this fix from upstream, and RHOSP 16.2 is in Extended Life Support Term 3. ELS3 only ships qualified Critical and Important RHSAs, plus Moderate CVEs with CVSS 7.0 or higher. This flaw is Moderate, so no security update is planned for 16.2. Red Hat OpenStack Services on OpenShift 18.0 ships OpenStack Watcher as the Optimize service. The /v1/webhooks/ endpoint is deployed and reachable on the same Watcher REST API as the rest of the service, and it cannot be bound to a separate network. Event-based audits cannot be disabled. They are always available. Red Hat documents only OneShot and Continuous audits as supported in RHOSO 18.0. Hardening may still be backported to 18.0. Event-based audits are planned for a later release.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[10.0.0,20.0.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[21.0.0,21.0.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[22.0.0,22.0.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "aodh", "vendor": "openstack"}], "created": "2026-08-20T10:45:03.412185+00:00", "updated": "2026-08-21T21:16:07.644082+00:00", "vendors": ["openstack", "openstack$PRODUCT$aodh"]}