Your message dated Mon, 05 Oct 2026 10:05:13 +0000
with message-id <[email protected]>
and subject line Bug#1150009: fixed in gnocchi 4.7.0-7
has caused the Debian Bug report #1150009,
regarding Cross-project metric association bypass in Gnocchi
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1150009: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1150009
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: gnocchi
Version: 4.6.5-1
Severity: important
Tags: patch security
X-Debbugs-Cc: Debian Security Team <[email protected]>
This issue is now public, as per:
https://review.opendev.org/c/openstack/security-doc/+/1007657
so I'm opening the bug and releasing the fixes.
id: OSSN-0112
title: Cross-project metric association bypass in Gnocchi
date: '2026-09-28'
affected-services: |
- Gnocchi (all versions prior to 4.6.6 and 4.7.1)
summary: |
The Gnocchi metric creation endpoint allows authenticated users to associate
metrics with resources owned by others by passing resource_id in the request
body bypassing proper authorization checks.
This improper access control enables attackers to inject arbitrary measures
into resources, squat on metric names, and trigger downstream actions
including
Aodh alarms and Heat scaling policies across project boundaries.
discussion: |
The Gnocchi API did not apply any policy when passing ``resource_id`` in the
request body when creating metrics using ``POST /v1/metric``.
This allowed an attacker to create metrics for another project's resources if
the resource UUID was known or could be enumerated.
The attacker can push measures to this metric potentially affecting Aodh
alarms
and thus Heat scaling policies that could trigger stack changes that causes
changes in OpenStack resources on the project.
The attacker can use this to squat on metric names, other members in the
project
cannot delete metrics created by the attacker due to (correct) policy
enforcement.
recommended-actions: |
Upgrade to a version containing the fix or apply the relevant patch and
restart
the Gnocchi API service.
**Patches:**
- master (development):
https://github.com/gnocchixyz/gnocchi/commit/db32814f594bae25a8483c6d9af4e6378191b7c3
- 4.7 release series:
https://github.com/gnocchixyz/gnocchi/commit/5078143c29efa53cffaf8c456ce94baaa6e88724
- 4.6 release series:
https://github.com/gnocchixyz/gnocchi/commit/0672fc6a40319e5d632d727afa6aaa5031651ff5
credits: swdb
references:
links:
- description: This OSSN
url: https://docs.openstack.org/security-notes/OSSN-0112.html
- description: GitHub Advisory
url:
https://github.com/gnocchixyz/gnocchi/security/advisories/GHSA-cjq3-6hm7-q33w
author: Tobias Urdin (Binero)
--- End Message ---
--- Begin Message ---
Source: gnocchi
Source-Version: 4.7.0-7
Done: Thomas Goirand <[email protected]>
We believe that the bug you reported is fixed in the latest version of
gnocchi, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thomas Goirand <[email protected]> (supplier of updated gnocchi package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 05 Oct 2026 11:40:33 +0200
Source: gnocchi
Architecture: source
Version: 4.7.0-7
Distribution: unstable
Urgency: high
Maintainer: Debian OpenStack <[email protected]>
Changed-By: Thomas Goirand <[email protected]>
Closes: 1150009
Changes:
gnocchi (4.7.0-7) unstable; urgency=high
.
* Removed add-header = Connection: close from gnocchi-api-uwsgi.ini.
* OSSN-0112: Improper Access Control through /metric/v1/metric via POST
parameter "resource_id". Added patch: "Enforce update resource policy
metric creation" (Closes: #1150009):
- OSSN-0112_Enforce-update-resource-policy-metric-creation-st....patch
* Add fix-test-discovery-without-proton.patch.
Checksums-Sha1:
62e768913032b59148486e0350bddfe1b191b8c2 3530 gnocchi_4.7.0-7.dsc
58115808cfe4594691f760020bbcf01481d8853d 15976 gnocchi_4.7.0-7.debian.tar.xz
8922e8016772a7cc27bdfb27c6458e152da27f65 17461 gnocchi_4.7.0-7_amd64.buildinfo
Checksums-Sha256:
aa38612d1a8fad32e4f7b25e84d8a19341057e42a23c0552fd6dd663f9936a0c 3530
gnocchi_4.7.0-7.dsc
c02c4d33c9a6afc2ac866641a84aa48723e0cd886a25c99454eb057ea82ad635 15976
gnocchi_4.7.0-7.debian.tar.xz
8407e52bee45e4b24a91addd8504de82a6f54cd31f8d59ec564f69f781928a97 17461
gnocchi_4.7.0-7_amd64.buildinfo
Files:
b2132a7bdd43a3e0af179b0e73145d3e 3530 net optional gnocchi_4.7.0-7.dsc
e63a865381860b51e29cd154b54e8e00 15976 net optional
gnocchi_4.7.0-7.debian.tar.xz
c25407d56e914a6eebf8348a7b11d62e 17461 net optional
gnocchi_4.7.0-7_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmrDcR4ACgkQ1BatFaxr
Q/6E9w//ZN7qPXICs1fQJDYASh7DgsKIvBsY17CTyzkT+GBD0ydeXWgf07THYCu9
T6bpit/qpQ7jhmzo7YEy+tQzqWS8zlGi9fXL7CWbvaTro/gHOZCH0GXH6lrd2rLx
lxtd38bTPjOev/dPOtpfkpux1f5OSr2Ez3oBk92oIk02idibnKUuZLz82cyGomkf
aKXhbMr9xSZ8Ngz33qt1/BOgKColUSGhP8cd7c/oLvaF/7nAGPvAggcetS7RY3so
groMJ45EuzzkDZ3eQynDn+y7swCKQOPVgX4s70ViFyKQmZWwlXzztPAMEdA+ZgP0
GoU6ADnTVCpv7hw/JghgXNqEQGxZlRZo6mejKj9/bly9aKKSn6iW54Kbaotqo6dT
e8tspbMh5D/IyY9OXadPlQKKaerDHctYo6UcX0ArJkx4xtD1eP5dNQGBboC+t/8n
anS2331WUE9DZjkU9vKJSOfWccB2CxfstfMb1HKegG/76at35Wm2p1VEfuAllJbP
rZ9BzgTeIjnrcdYrGG9x7aCXUxGu4tEjkoSIpJQRiImm7F2ugCw3sjs5QSQYEAnM
NWbsCEu62jdjRY0XOSSeNs1Q0XkjQ8m8Cys30iOHCS3lHkkO5+ZZt/8ypD1K0ctY
o2TtZlBfJfPYTBRcsN+F5xjHScfZ0W3DgkWc0BbBIip71+OnzOk=
=HhuL
-----END PGP SIGNATURE-----
pgpjoej4FaGbx.pgp
Description: PGP signature
--- End Message ---
