EUVD-2026-63137
GHSA-25rc-jgc5-f99w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L confirmed by reader-role requirement; S:C and I:H reflect cross-system Watcher action plan execution; A:N as no availability impact is described.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the all_projects query parameter is set to false. The API checks for the presence of the all_projects key rather than its value; a true value enforces the administrator-only policy, but a false value removes the key and skips the branch that normally restricts results to the caller's project. A non-admin user with the reader role can list alarms from all projects, exposing alarm actions containing trust webhook URLs, Heat signal endpoints, project IDs, and user IDs. The parameter can also be combined with a foreign project_id to target a specific project's alarms. A related concern is that OpenStack Watcher does not apply authorization to its webhook trigger endpoint. Any authenticated user who learns an audit's webhook URL, for example from this leaked Aodh alarm metadata, can start an EVENT audit and its associated action plan regardless of their own project or role. The webhook endpoint has lacked policy enforcement since its introduction in the Ussuri release (Watcher 4.0.0).
AnalysisAI
Authorization bypass in OpenStack Aodh's alarm list API allows any authenticated user with the reader role to enumerate alarms across all projects by exploiting a logic flaw where passing all_projects=false removes the project-scoping key entirely rather than restricting scope - exposing trust webhook URLs, Heat signal endpoints, project IDs, and user IDs from foreign projects. The leaked webhook URLs directly enable a second-stage attack against OpenStack Watcher, whose webhook trigger endpoint has enforced no authorization since the Ussuri release (Watcher 4.0.0), permitting any authenticated user who obtains a webhook URL to start EVENT audits and execute associated action plans against arbitrary projects. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation of the Aodh flaw requires a valid OpenStack credential with at minimum the reader role in any project - no administrative privileges are needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L) correctly characterizes this as low-complexity, network-reachable exploitation requiring only a valid project credential - a very low bar in multi-tenant OpenStack deployments where reader-role accounts are routinely issued to service operators, tenants, and monitoring tools. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A cloud tenant with a reader-role credential issues a GET request to the Aodh alarms API with the query parameter `all_projects=false`, receiving the full cross-tenant alarm list including `alarm_actions` fields containing Watcher EVENT audit webhook URLs and Heat signal endpoints from other projects. The attacker then makes an unauthenticated-equivalent HTTP POST to one of the leaked Watcher webhook URLs, triggering an EVENT audit and its associated optimization action plan - potentially causing resource migrations, deletions, or configuration changes in a victim tenant's infrastructure. … |
| Remediation | Upgrade OpenStack Aodh to version 22.0.1 or later, which is the vendor-confirmed fix version per the description and the OSSA-2026-036 advisory at https://security.openstack.org/ossa/OSSA-2026-036.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all OpenStack Aodh and Watcher deployments in production, document running versions, and implement network-level access restrictions to Aodh alarm list API endpoints (/v2/alarms) limiting connectivity to administrative users only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today