Source: gnocchi Version: 4.6.5-1 Severity: important Tags: patch security X-Debbugs-Cc: Debian Security Team <[email protected]>
This issue is now public, as per: https://review.opendev.org/c/openstack/security-doc/+/1007657 so I'm opening the bug and releasing the fixes. id: OSSN-0112 title: Cross-project metric association bypass in Gnocchi date: '2026-09-28' affected-services: | - Gnocchi (all versions prior to 4.6.6 and 4.7.1) summary: | The Gnocchi metric creation endpoint allows authenticated users to associate metrics with resources owned by others by passing resource_id in the request body bypassing proper authorization checks. This improper access control enables attackers to inject arbitrary measures into resources, squat on metric names, and trigger downstream actions including Aodh alarms and Heat scaling policies across project boundaries. discussion: | The Gnocchi API did not apply any policy when passing ``resource_id`` in the request body when creating metrics using ``POST /v1/metric``. This allowed an attacker to create metrics for another project's resources if the resource UUID was known or could be enumerated. The attacker can push measures to this metric potentially affecting Aodh alarms and thus Heat scaling policies that could trigger stack changes that causes changes in OpenStack resources on the project. The attacker can use this to squat on metric names, other members in the project cannot delete metrics created by the attacker due to (correct) policy enforcement. recommended-actions: | Upgrade to a version containing the fix or apply the relevant patch and restart the Gnocchi API service. **Patches:** - master (development): https://github.com/gnocchixyz/gnocchi/commit/db32814f594bae25a8483c6d9af4e6378191b7c3 - 4.7 release series: https://github.com/gnocchixyz/gnocchi/commit/5078143c29efa53cffaf8c456ce94baaa6e88724 - 4.6 release series: https://github.com/gnocchixyz/gnocchi/commit/0672fc6a40319e5d632d727afa6aaa5031651ff5 credits: swdb references: links: - description: This OSSN url: https://docs.openstack.org/security-notes/OSSN-0112.html - description: GitHub Advisory url: https://github.com/gnocchixyz/gnocchi/security/advisories/GHSA-cjq3-6hm7-q33w author: Tobias Urdin (Binero)
