In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the all_projects query parameter is set to false. The API checks for the presence of the all_projects key rather than its value; a true value enforces the administrator-only policy, but a false value removes the key and skips the branch that normally restricts results to the caller's project. A non-admin user with the reader role can list alarms from all projects, exposing alarm actions containing trust webhook URLs, Heat signal endpoints, project IDs, and user IDs. The parameter can also be combined with a foreign project_id to target a specific project's alarms. A related concern is that OpenStack Watcher does not apply authorization to its webhook trigger endpoint. Any authenticated user who learns an audit's webhook URL, for example from this leaked Aodh alarm metadata, can start an EVENT audit and its associated action plan regardless of their own project or role. The webhook endpoint has lacked policy enforcement since its introduction in the Ussuri release (Watcher 4.0.0).
CVE-2026-76878
This high-severity CVE scores 8.4 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit probability: 0.4%, top 67% of all CVEs by exploit prediction. GitHub Security Advisory data not yet ingested — confidence will rise once GHSA publishes (typical lag: hours to days for open-source ecosystem CVEs; never for infrastructure-only CVEs).
- High severity, but no confirmed exploitation yet
No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.
- CVSS v3
- 8.4
- EG Score
- 8.4(medium)
- EG Risk
- 38(Track)EG Risk 38/100SSVC: Track
EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).
How it’s computedSeverity84% × 45%Exploitation0% × 40%Automatability0% × 15%Action: Routine — remediate on your standard cadence. - EPSS PROB
- 0%
- EPSS %ILE
- 33%
- KEV
- Not listed
Published
August 19, 2026
Last Modified
August 21, 2026
Advisory Details (5)
Auto-updated Aug 19, 2026oss-security - [OSSA-2026-036] OpenStack Aodh and Watcher: Aodh cross-project alarm enumeration and Watcher webhook authorization bypass (CVE-2026-pending)
https://www.openwall.com/lists/oss-security/2026/08/19/5[OSSA-2026-036] OpenStack Aodh and Watcher: Aodh cross-project alarm enumeration and Watcher webhook authorization bypass (CVE-2026-pending) - OpenStack-announce - lists.openstack.org
https://lists.openstack.org/archives/list/[email protected]/thread/O6PKAUNMNZP6FRHLUUGBYELCRBEPB52B/OSSA-2026-036: Aodh cross-project alarm enumeration and Watcher webhook authorization bypass — OpenStack Security Advisories 0.0.1.dev373 documentation
https://security.openstack.org/ossa/OSSA-2026-036.htmlBug #2161771 “[OSSA-2026-036] Watcher Lets an Unrelated Authenti...” : Bugs : OpenStack Security Advisory
https://launchpad.net/bugs/2161771Bug #2161276 “[OSSA-2026-036] Aodh all_projects=false bypasses p...” : Bugs : OpenStack Security Advisory
https://launchpad.net/bugs/2161276Vendor Advisories for CVE-2026-76878(1)
These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.
Weakness Classification(1)
MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.
Data Freshness Timeline
(refreshed 13× in last 7d / 13× in last 30d)
Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.
- 2026-08-21 02:17 UTCEG score recompute
- 2026-08-21 02:17 UTCGHSA enrichment
- 2026-08-21 01:56 UTCEG score recompute
- 2026-08-21 01:56 UTCGHSA enrichment
- 2026-08-20 22:56 UTCEPSS rescore
- 2026-08-20 16:34 UTCEG score recompute
- 2026-08-20 16:34 UTCGHSA enrichment
- 2026-08-20 15:45 UTCEG score recompute
- 2026-08-20 15:45 UTCGHSA enrichment
- 2026-08-20 10:09 UTCGHSA enrichment
- 2026-08-19 22:20 UTCEG score recompute
- 2026-08-19 22:09 UTCEG score recompute
- 2026-08-19 22:07 UTCMITRE cvelistV5first tracked
Frequently asked(5)
What is CVE-2026-76878?
When was CVE-2026-76878 disclosed?
Is CVE-2026-76878 actively exploited?
What is the CVSS score of CVE-2026-76878?
How do I remediate CVE-2026-76878?
Dependency Blast Radius
Explore the affected products and dependency analysis for CVE-2026-76878
Is Your Infrastructure Affected by CVE-2026-76878?
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.