https://seclists.org/oss-sec/2026/q3/542: [OSSA-2026-036] OpenStack Aodh and Watcher: Aodh cross-project alarm enumeration and Watcher webhook authorization bypass (CVE-2026-76878) errata 1

Q: Which users can access alarm information outside their own project?

A non-admin user with only the reader role can list alarms belonging to other projects through Aodh's alarm listing API. This affects all Aodh deployments.

Q: What does an attacker need to trigger a Watcher audit across authorization boundaries?

The attacker must be authenticated and know an audit's webhook URL. Such URLs may be obtained from alarm metadata exposed by the Aodh issue, including webhook action URLs and signal endpoints.

Q: Which releases are affected?

Affected Aodh releases are >=10.0.0 and <20.0.1, plus 21.0.0 and 22.0.0. Affected Watcher releases are >=4.0.0 and <14.1.2, >=15.0.0 and <15.1.2, and >=16.0.0 and <16.0.2.

Published Aug 20, 2026

Updated

Affected Software

2 affected components

Openstack Aodh>=10.0.0<20.0.1, =21.0.0, =22.0.0

Openstack Watcher>=4.0.0<14.1.2, >=15.0.0<15.1.2, >=16.0.0<16.0.2

Frequently Asked Questions

Which users can access alarm information outside their own project?

A non-admin user with only the reader role can list alarms belonging to other projects through Aodh's alarm listing API. This affects all Aodh deployments.

What does an attacker need to trigger a Watcher audit across authorization boundaries?

The attacker must be authenticated and know an audit's webhook URL. Such URLs may be obtained from alarm metadata exposed by the Aodh issue, including webhook action URLs and signal endpoints.

Which releases are affected?

Affected Aodh releases are >=10.0.0 and <20.0.1, plus 21.0.0 and 22.0.0. Affected Watcher releases are >=4.0.0 and <14.1.2, >=15.0.0 and <15.1.2, and >=16.0.0 and <16.0.2.