Version in base suite: 20.0.0-2 Base version: aodh_20.0.0-2 Target version: aodh_20.0.0-2+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/a/aodh/aodh_20.0.0-2.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/a/aodh/aodh_20.0.0-2+deb13u1.dsc changelog | 13 ++ patches/CVE-2026-76878-aodh-lp-2161276-2025.1.patch | 101 ++++++++++++++++++++ patches/series | 1 3 files changed, 115 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmps2_x4pil/aodh_20.0.0-2.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmps2_x4pil/aodh_20.0.0-2+deb13u1.dsc: no acceptable signature found diff -Nru aodh-20.0.0/debian/changelog aodh-20.0.0/debian/changelog --- aodh-20.0.0/debian/changelog 2025-07-11 10:12:52.000000000 +0000 +++ aodh-20.0.0/debian/changelog 2026-08-12 07:57:24.000000000 +0000 @@ -1,3 +1,16 @@ +aodh (20.0.0-2+deb13u1) trixie; urgency=medium + + * CVE-2026-76878 / OSSA-2026-036: Aodh does not correctly enforce project + scope when the all_projects query parameter is present with a false value. + A non-admin project reader can list alarms belonging to other projects by + passing all_projects=false in a list query, optionally combined with a + foreign project_id to target a specific project. Leaked alarm data includes + trust webhook URLs, Heat signal endpoints, and project identifiers. Applied + upstream patch: "Fix all_projects=false bypass project scope" + (Closes: #1144879). + + -- Thomas Goirand Wed, 12 Aug 2026 09:57:24 +0200 + aodh (20.0.0-2) unstable; urgency=medium * Set export OS_OSLO_MESSAGING_RABBIT__PROCESSNAME for all daemons. diff -Nru aodh-20.0.0/debian/patches/CVE-2026-76878-aodh-lp-2161276-2025.1.patch aodh-20.0.0/debian/patches/CVE-2026-76878-aodh-lp-2161276-2025.1.patch --- aodh-20.0.0/debian/patches/CVE-2026-76878-aodh-lp-2161276-2025.1.patch 1970-01-01 00:00:00.000000000 +0000 +++ aodh-20.0.0/debian/patches/CVE-2026-76878-aodh-lp-2161276-2025.1.patch 2026-08-12 07:57:24.000000000 +0000 @@ -0,0 +1,101 @@ +Description: Fix all_projects=false bypass project scope + Modify how all_projects is handled in queries using the alarms endpoint. + Previously using all_project=false would allow skipping a branch of the + code, which scopes requests to the current project. With the new code, + when all_projects=false is present, the project scoping is done as + originally intended. +Author: Jaromir Wysoglad +Date: Tue, 28 Jul 2026 09:51:51 +0000 +Bug: https://launchpad.net/bugs/2161276 +Bug-Debian: https://bugs.debian.org/1144879 +Change-Id: Ia0ffb21b3928a1677dd97c0e26686f53fd9f9bef +Signed-off-by: Jaromir Wysoglad +Origin: upstream, pre-OSSA mailing list +Last-Update: 2026-08-12 + +diff --git a/aodh/api/controllers/v2/alarms.py b/aodh/api/controllers/v2/alarms.py +index 92163c90..bf11b1c5 100644 +--- a/aodh/api/controllers/v2/alarms.py ++++ b/aodh/api/controllers/v2/alarms.py +@@ -887,11 +887,10 @@ class AlarmsController(rest.RestController): + 'only operations %s are allowed' % ALARM_QUERY_OPS_ALLOWED + ) + +- if 'all_projects' in keys: +- if v2_utils.get_query_value(q, 'all_projects', 'boolean'): +- rbac.enforce('get_alarms:all_projects', pecan.request, +- pecan.request.enforcer, target) +- keys.remove('all_projects') ++ if ('all_projects' in keys and ++ v2_utils.get_query_value(q, 'all_projects', 'boolean')): ++ rbac.enforce('get_alarms:all_projects', pecan.request, ++ pecan.request.enforcer, target) + else: + project_id = pecan.request.headers.get('X-Project-Id') + is_admin = rbac.is_admin(pecan.request, pecan.request.enforcer) +@@ -905,6 +904,7 @@ class AlarmsController(rest.RestController): + request_project = v2_utils.get_query_value(q, 'project_id') + if not is_admin and request_project != project_id: + raise base.ProjectNotAuthorized(request_project) ++ keys.discard('all_projects') + + for query in q: + if query.field in keys: +diff --git a/aodh/tests/functional/api/v2/test_alarm_scenarios.py b/aodh/tests/functional/api/v2/test_alarm_scenarios.py +index 4a997540..210a5d30 100644 +--- a/aodh/tests/functional/api/v2/test_alarm_scenarios.py ++++ b/aodh/tests/functional/api/v2/test_alarm_scenarios.py +@@ -219,6 +219,36 @@ class TestAlarms(TestAlarmsBase): + + _test('project_id') + ++ def test_get_alarm_all_projects_true_normal_user(self): ++ response = self.get_json( ++ '/alarms', ++ headers=self.auth_headers, ++ q=[{'field': 'all_projects', 'op': 'eq', 'value': 'true'}], ++ expect_errors=True, ++ status=403 ++ ) ++ faultstring = 'RBAC Authorization Failed' ++ self.assertIn(faultstring, ++ response.json['error_message']['faultstring']) ++ ++ def test_get_alarm_all_projects_false_normal_user(self): ++ alarms = self.get_json( ++ '/alarms', ++ headers=self.auth_headers, ++ q=[{'field': 'all_projects', 'op': 'eq', 'value': 'false'}] ++ ) ++ self.assertEqual(3, len(alarms)) ++ ++ def test_get_alarm_all_projects_false_normal_user_from_other_project(self): ++ auth_headers = copy.copy(self.auth_headers) ++ auth_headers['X-Project-Id'] = 'other-project' ++ alarms = self.get_json( ++ '/alarms', ++ headers=auth_headers, ++ q=[{'field': 'all_projects', 'op': 'eq', 'value': 'false'}] ++ ) ++ self.assertEqual(0, len(alarms)) ++ + def test_get_alarm_forbiden(self): + pf = os.path.abspath('aodh/tests/functional/api/v2/policy.yaml-test') + self.CONF.set_override('policy_file', pf, group='oslo_policy') +diff --git a/releasenotes/notes/fix-all-projects-bypass-project-scope-7b9a64d168f12353.yaml b/releasenotes/notes/fix-all-projects-bypass-project-scope-7b9a64d168f12353.yaml +new file mode 100644 +index 00000000..143cd241 +--- /dev/null ++++ b/releasenotes/notes/fix-all-projects-bypass-project-scope-7b9a64d168f12353.yaml +@@ -0,0 +1,9 @@ ++--- ++security: ++ - | ++ Fixed a vulnerability where passing ``all_projects=false`` in alarm ++ queries bypassed project scope filtering. Previously, the presence ++ of ``all_projects`` in the query caused the project scoping logic to ++ be skipped entirely, allowing non-admin users to list alarms from ++ all projects. Queries with ``all_projects=false`` or without ++ ``all_projects`` now correctly restrict results to the caller's project. +-- +2.43.0 diff -Nru aodh-20.0.0/debian/patches/series aodh-20.0.0/debian/patches/series --- aodh-20.0.0/debian/patches/series 2025-07-11 10:12:52.000000000 +0000 +++ aodh-20.0.0/debian/patches/series 2026-08-12 07:57:24.000000000 +0000 @@ -2,3 +2,4 @@ remove-wsmeext.sphinxext.patch remove-httpdomain-sphinx-ext.patch add-a-healthcheck_disable-file.patch +CVE-2026-76878-aodh-lp-2161276-2025.1.patch