Loading story…
OpenStack disclosed OSSA-2026-036 for two authorization flaws in Aodh and Watcher, later tracked as CVE-2026-76878 with a CVSS 4.0 score of 8.4. In Aodh, versions before 22.0.1 improperly enforced project scope in the alarm listing API, allowing a non-admin user with only the reader role to enumerate alarms from other projects by supplying the all_projects parameter with a false value. The exposure can reveal alarm metadata including webhook URLs, Heat signal endpoints, project IDs, and user IDs, and can be further narrowed by providing a foreign project_id.
In Watcher, the webhook trigger endpoint lacked authorization checks, allowing any authenticated user who knows an audit webhook URL to start an EVENT audit and its associated action plan regardless of project or role. The advisory said affected Watcher deployments have carried the missing policy enforcement since the Ussuri release line, identified as Watcher 4.0.0, and that patches were issued across multiple OpenStack branches. The issues were reported by Chen YuXiang of the Institute of Computing Technology, Chinese Academy of Sciences.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-76878 was published on August 19, 2026 for the combined Aodh and Watcher authorization issues, with a CVSS 4.0 base score of 8.4 and High severity.
On August 19, 2026, OpenStack disclosed OSSA-2026-036 covering an Aodh project-scope enforcement flaw and a Watcher webhook authorization bypass, and published fixes for supported release branches.
OpenStack requested a CVE identifier from MITRE for the Aodh vulnerability, noting in the advisory that the identifier would be added later by errata once assigned.
Launchpad bug 2161276 was published for the Aodh issue later covered by OSSA-2026-036, tracking the all_projects=false scope bypass in the alarm listing API.
Launchpad bug 2161771 was published for the Watcher issue later covered by OSSA-2026-036, documenting that an unrelated authenticated user could trigger a Watcher webhook.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourceseclists.org
Open sourcelaunchpad.net
Open sourcelaunchpad.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities in OpenClaw exposed paths for authenticated users to gain access beyond their intended roles. **CVE-2026-32042** affects versions before `2026.2.25` and allows an attacker with valid shared gateway authentication to present a self-signed, unpaired device identity and bypass pairing requirements, then self-assign elevated operator scopes including `operator.admin`. The issue is classified as `CWE-863` and effectively turns a trusted but unapproved device identity into a route for privilege escalation. A second flaw, **CVE-2026-32051**, affects OpenClaw versions before `2026.3.1` and allows users with `operator.write` scope to reach owner-only tool surfaces such as gateway and cron through agent runs in scoped-token deployments. The authorization mismatch lets lower-privileged authenticated users perform control-plane actions that should be restricted to owners, creating high risk to confidentiality, integrity, and availability. Advisories for both issues point to fixes and security guidance through GitHub and VulnCheck.
Jun 29, 2026
Multiple vendors issued fixes for **high-impact vulnerabilities** that could enable privilege escalation, tenant-wide compromise, security feature bypass, or remote code execution. OpenStack patched **CVE-2026-22797** in *keystonemiddleware* affecting deployments using `external_oauth2_token`, where failure to sanitize incoming identity headers allows authenticated users to forge headers (e.g., `X-Is-Admin-Project`, `X-Roles`, `X-User-Id`) to **escalate privileges or impersonate other users**; fixes were released across supported branches and the issue was reported by a Red Hat researcher. Microsoft patched **CVE-2026-20965** in *Windows Admin Center*’s Azure SSO (fixed in Azure Extension **v0.70.00**), where improper token validation could let an attacker with local admin on a WAC-enabled Azure VM/Arc machine combine a stolen `WAC.CheckAccess` token with a forged PoP token to enable **lateral movement and tenant-wide access** under certain conditions. Separately, Microsoft addressed **CVE-2026-20824** in *Windows Remote Assistance*, an **Important** security feature bypass that can allow attackers to evade **Mark of the Web (MOTW)** protections via social engineering. Progress Software also released patches for **CVE-2025-13444** and **CVE-2025-13447** (CVSS 8.4) affecting *LoadMaster* and *MOVEit WAF*, where crafted UI/API requests can trigger **command injection leading to remote code execution**; the vendor stated it had no evidence of in-the-wild exploitation at the time of release.
Jun 29, 2026
OpenStack disclosed **OSSA-2026-031**, a denial-of-service flaw in the **Swift proxy server** that lets an unauthenticated attacker make object storage services unavailable by sending crafted HTTP requests. The issue stems from **catastrophic regular-expression backtracking** in Swift’s `Accept` header parser, which can consume proxy worker threads until the service stops responding. The vulnerability affects Swift versions `>=1.9.1 and <2.35.4`, `>=2.36.0 and <2.36.3`, `>=2.37.0 and <2.37.3`, and `2.38.0`, and was tracked at disclosure as **`CVE-2026-pending`**. OpenStack published fixed releases and patches for the **2025.1**, **2025.2**, **2026.1**, and **2026.2** development branches, and the issue was reported by **Christian Schwede of NVIDIA** through bug **`#2158771`** before public advisory release.
Aug 5, 2026