USN-8870-1: authorization flaws in OpenStack Aodh and Watcher

Notice USN-8870-1, published on October 5, 2026 in the Ubuntu Security feed. According to the text, OpenStack Aodh did not correctly enforce project scope in its alarm listing API, and the webhook trigger endpoint of OpenStack Watcher did not enforce authorization. The finding is credited to Chen YuXiang. An attacker could possibly use these flaws to access sensitive alarm metadata or trigger unauthorized action plans. The indicated content is an automatic translation of the original notice, so check technical terms against the official text. Relevance: organizations running OpenStack with Aodh or Watcher should verify they are on fixed versions, following guidance from the vendor or distribution. Rota Nacional does not patch or replace cloud infrastructure components, and this notice does not describe any platform feature. Privacy: alarm metadata may contain identifiers for systems, projects or people, so review who can reach these APIs. To verify, consult the original notice through the distribution's official channel and confirm the installed version of the affected packages.