CVE-2026-76878 is being labeled as an Aodh vulnerability, but treating it as such will cause you to miss the actual attack surface. This is a two-stage chain: Aodh provides reconnaissance, Watcher provides the exploitation vector—and Watcher's exposure predates this disclosure by five years.
The Aodh flaw is a subtle Python idiom failure. The code checks for key presence (if 'all_projects' in params) rather than extracting and validating the boolean value (if params.get('all_projects')). When a checkbox UI sends all_projects=false, the parameter is absent entirely—Python treats this as falsy, the key-existence check fails, and the project-scoped filtering branch never executes. Any authenticated user can enumerate alarms across all projects, extracting webhook URLs, Heat signal endpoints, and project/user identifiers.
But the Aodh vulnerability is not the terminal harm—it is the reconnaissance layer. Watcher's webhook trigger endpoint has lacked any authorization since the Ussuri release (2020). The security model relies on URL secrecy: if you possess the webhook URL, you can trigger EVENT audits and execute their associated action plans regardless of your project membership or role. This is not a bug that slipped in unnoticed; it was an architectural decision, since superseded by the very existence of Aodh as an enumeration vector.
The practical impact: an authenticated user who obtains a Watcher webhook URL can invoke infrastructure-altering action plans without any administrative privileges. Watcher action plans typically execute against compute, storage, or network resources. The attack chain bypasses role-based access controls entirely because the authorization gap lives at the webhook boundary, not within Watcher's internal logic.
Treat Watcher as independently vulnerable regardless of whether you patch Aodh. The underlying authorization absence has existed since 2020, and fixing Aodh does not remediate it. Inventory your Watcher deployments: what action plans are configured, which ones can manipulate infrastructure, and whether any permit cross-tenant operations or privilege escalation. The Watcher webhook endpoint cannot be patched without breaking existing integrations that depend on URL-based access control—the exposure is architecturally permanent for any deployment where webhook URLs have been logged, stored in monitoring systems, or accessible to the population of authenticated users who have accumulated over five years of compound access.
Your priority: identify Watcher action plans with infrastructure-modifying capabilities, treat the webhook endpoint as publicly accessible despite its internal appearance, and recognize that this disclosure collapses the reconnaissance cost to zero—transforming latent exposure into active attack surface.