OpenStack Aodh CVE-2026-76878

OpenStack Aodh is the telemetry alarming service within the OpenStack ecosystem, providing alarm management via a REST API. The vulnerability (CWE-688: Function Call With Incorrect Variable or Reference as Argument) stems from the API handler checking for the mere presence of the all_projects query parameter key rather than evaluating its boolean value: supplying all_projects=true causes the code to enter a branch that enforces an administrator-only policy, but supplying all_projects=false causes the key to be absent from the internal parameter map, silently bypassing the authorization check and returning all alarms globally. This class of boolean-handling error is common in query-parameter parsing logic that conflates key absence with false. The secondary issue in OpenStack Watcher (the optimization service) is a separate missing-authorization defect: its EVENT audit webhook trigger endpoint, introduced in Watcher 4.0.0 (Ussuri cycle), was never gated by any policy enforcement, making it callable by any authenticated user who possesses the URL. The two flaws chain: Aodh leaks Watcher webhook URLs, and Watcher's endpoint enforces no access control on those URLs. Affected versions per the advisory are OpenStack Aodh before 22.0.1, and OpenStack Watcher from 4.0.0 through at least the version current at disclosure.