CVE-2026-76878

A flaw was found in OpenStack Aodh and Watcher. In Aodh, the alarm listing API does not correctly enforce project scope when the allprojects query parameter is present with a false value. A non-admin authenticated user can list alarms belonging to other projects, potentially exposing alarm...

EUVD-2026-63137

In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the allprojects query parameter is set to false. The API checks for the presence of the allprojects key rather than its value; a true value enforces the administrator-only policy, but a false value removes the key a...

Linux Distros Unpatched Vulnerability : CVE-2026-76878

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the allprojects query parameter is set to false. The API checks for the presen...

CVE-2026-76878

In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the allprojects query parameter is set to false. The API checks for the presence of the allprojects key rather than its value; a true value enforces the administrator-only policy, but a false value removes the key a...

DEBIAN-CVE-2026-76878

In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the allprojects query parameter is set to false. The API checks for the presence of the allprojects key rather than its value; a true value enforces the administrator-only policy, but a false value removes the key a...

CVE-2026-76878

CVE-2026-76878 affects OpenStack Aodh (before 22.0.1) and OpenStack Watcher (since Ussuri/Watcher 4.0.0). In Aodh, the alarm list API checks for the presence of the all_projects key rather than its value, so setting it to false removes the key and skips project-scoping logic. A non-admin user wit...

CVE-2026-76878

In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the allprojects query parameter is set to false. The API checks for the presence of the allprojects key rather than its value; a true value enforces the administrator-only policy, but a false value removes the key a...

PT-2026-78838

Name of the Vulnerable Software and Affected Versions OpenStack Aodh versions prior to 22.0.1 OpenStack Watcher versions 4.0.0 and later Description In OpenStack Aodh, the alarm list API fails to properly enforce project scoping when the all projects query parameter is set to false. The system...

RHSA-2018:0315 Red Hat Security Advisory: openstack-aodh security update

Bulletin has no description...

RHEL 7 : openstack-aodh (RHSA-2018:0315)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:0315 advisory. openstack-aodh provides the ability to trigger actions based on defined rules against metric or event data collected by OpenStack Telemetry ceilomete...

RHEL 7 : openstack-aodh (RHSA-2017:3227)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:3227 advisory. openstack-aodh provides the ability to trigger actions based on defined rules against metric or event data collected by OpenStack Telemetry ceilomete...

GHSA-86CV-9GPX-6HWJ Openstack Aodh can be used to launder Keystone trusts

Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust ID...

Openstack Aodh can be used to launder Keystone trusts

Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust ID...

openstack-aodh: Aodh can be used to launder Keystone trusts

A verification flaw was found in openstack-aodh. As part of an HTTP alarm action, a user could pass in a trust ID. However, the trust could be from anyone because it was not verified. Because the trust was then used by openstack-aodh to obtain a keystone token for the alarm action, a malicious us...

Moderate: Red Hat Security Advisory: openstack-aodh security update

An update for openstack-aodh is now available for Red Hat OpenStack Platform 11.0 Ocata. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

SUSE-SU-2017:2627-1 Security update for openstack-aodh

This update for openstack-aodh fixes the following security issues: - CVE-2017-12440: Aodh did not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allowed remote authenticated users with knowledge of trust IDs where Aodh is the trustee to obta...

DEBIAN-CVE-2017-12440

Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust ID...