Executive brief
OpenStack Aodh is an alarm management service used in cloud deployments to monitor and track automated actions. A non-administrator user with basic read access can bypass project isolation controls and view alarms from other projects by setting a specific API parameter to false. This exposure reveals sensitive configuration including webhook URLs, Heat endpoints, project IDs, and user credentials, potentially allowing attackers to trigger unintended automated workflows in other projects.
Technical details
The vulnerability is an authorization bypass in the alarm list API endpoint. The vulnerable code checks for the presence of the all_projects query parameter rather than its boolean value; when set to false, the parameter is stripped and the code path that enforces project scope is skipped. A non-admin user with the reader role can invoke GET /v2/alarms?all_projects=false to list alarms from all projects, or combine it with project_id=<foreign-uuid> to target a specific other project. The vulnerability exposes alarm action metadata including trust webhook URLs, Heat signal endpoints, and project/user identifiers. Attack requires only network access and valid (but unprivileged) credentials; no admin role or additional authentication is needed. The fix is available in Aodh 22.0.1 and later versions.
Affected products
- OpenStack Aodh before 22.0.1
Timeline
- 2026-08-19: disclosed
- 2026-07-19: patched: Fix applied to upstream master; included in Aodh 22.0.1 release