# CVE-2026-76878: OpenStack Aodh project scoping bypass in alarm list API

Source: https://junglewise.ai/threats/cve-2026-76878-openstack-aodh-project-scoping-bypass-in-alarm-list-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-76878 · Severity: info · Published 2026-08-19

OpenStack Aodh is an alarm management service used in cloud deployments to monitor and track automated actions. A non-administrator user with basic read access can bypass project isolation controls and view alarms from other projects by setting a specific API parameter to false. This exposure reveals sensitive configuration including webhook URLs, Heat endpoints, project IDs, and user credentials, potentially allowing attackers to trigger unintended automated workflows in other projects.

Vendors: [OpenStack](https://junglewise.ai/threats/vendors/openstack).

## Quick answers

**Is CVE-2026-76878 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76878 being exploited in the wild.

**How severe is CVE-2026-76878?** Informational severity, published 19 August 2026.

**Which products and versions are affected?** OpenStack Aodh before 22.0.1.

**Is there a fix for CVE-2026-76878?** A patch was published on 2026-07-19: Fix applied to upstream master; included in Aodh 22.0.1 release Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76878 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-76878?** Check whether you run OpenStack Aodh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass in the alarm list API endpoint. The vulnerable code checks for the presence of the all_projects query parameter rather than its boolean value; when set to false, the parameter is stripped and the code path that enforces project scope is skipped. A non-admin user with the reader role can invoke GET /v2/alarms?all_projects=false to list alarms from all projects, or combine it with project_id=<foreign-uuid> to target a specific other project. The vulnerability exposes alarm action metadata including trust webhook URLs, Heat signal endpoints, and project/user identifiers. Attack requires only network access and valid (but unprivileged) credentials; no admin role or additional authentication is needed. The fix is available in Aodh 22.0.1 and later versions.

## Affected products

- OpenStack Aodh before 22.0.1

## Timeline

- 2026-08-19: disclosed
- 2026-07-19: patched: Fix applied to upstream master; included in Aodh 22.0.1 release

## References

- [https://launchpad.net/bugs/2161276](https://launchpad.net/bugs/2161276)
- [https://launchpad.net/bugs/2161771](https://launchpad.net/bugs/2161771)