Medium [CVE-2026-76878] aodh / python-watcher: cross-project alarm enumeration and webhook missing authorization
This medium-severity Red Hat Linux advisory covers CVE-2026-76878 affecting Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
A flaw was found in OpenStack Aodh and Watcher. In Aodh, the alarm listing API does not correctly enforce project scope when the all_projects query parameter is present with a false value.
A non-admin authenticated user can list alarms belonging to other projects, potentially exposing alarm configurations, webhook URLs, and project identifiers.
In Watcher, the webhook trigger endpoint does not enforce oslo.policy authorization, allowing any authenticated user who learns an audit webhook URL to trigger EVENT audits and associated action plans regardless of project or role. RHOSP 16.2 is affected.
That release does not receive this fix from upstream, and RHOSP 16.2 is in Extended Life Support Term 3. ELS3 only ships qualified Critical and Important RHSAs, plus Moderate CVEs with CVSS 7.0 or higher.
This flaw is Moderate, so no security update is planned for 16.2. Red Hat OpenStack Services on OpenShift 18.0 ships OpenStack Watcher as the Optimize service.
The /v1/webhooks/ endpoint is deployed and reachable on the same Watcher REST API as the rest of the service, and it cannot be bound to a separate network. Event-based audits cannot be disabled.
They are always available. Red Hat documents only OneShot and Continuous audits as supported in RHOSO 18.0.
Hardening may still be backported to 18.0.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Mitigation checklist
- Restrict network access to the Aodh API (default port 8042) and the Watcher API (default port 9322) to trusted administrative networks. Review Keystone role assignments to minimize users with project_reader or higher that can reach the Aodh API. The Watcher webhook path cannot be isolated from the main REST API. Keep enable_webhooks_auth=True (the default). Do not create or use event-based audits.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.