- Package:
- src:gnocchi
- Source:
- src:gnocchi
- Submitter:
- Thomas Goirand
- Date:
- 2026-10-05 11:45:01 UTC
- Severity:
- normal
- Tags:
This issue is now public, as per: https://review.opendev.org/c/openstack/security-doc/+/1007657 so I'm opening the bug and releasing the fixes. id: OSSN-0112 title: Cross-project metric association bypass in Gnocchi date: '2026-09-28' affected-services: | - Gnocchi (all versions prior to 4.6.6 and 4.7.1) summary: | The Gnocchi metric creation endpoint allows authenticated users to associate metrics with resources owned by others by passing resource_id in the request body bypassing proper authorization checks. This improper access control enables attackers to inject arbitrary measures into resources, squat on metric names, and trigger downstream actions including Aodh alarms and Heat scaling policies across project boundaries. discussion: | The Gnocchi API did not apply any policy when passing ``resource_id`` in the request body when creating metrics using ``POST /v1/metric``. This allowed an attacker to create metrics for another project's resources if the resource UUID was known or could be enumerated. The attacker can push measures to this metric potentially affecting Aodh alarms and thus Heat scaling policies that could trigger stack changes that causes changes in OpenStack resources on the project. The attacker can use this to squat on metric names, other members in the project cannot delete metrics created by the attacker due to (correct) policy enforcement. recommended-actions: | Upgrade to a version containing the fix or apply the relevant patch and restart the Gnocchi API service. **Patches:** - master (development): https://github.com/gnocchixyz/gnocchi/commit/db32814f594bae25a8483c6d9af4e6378191b7c3 - 4.7 release series: https://github.com/gnocchixyz/gnocchi/commit/5078143c29efa53cffaf8c456ce94baaa6e88724 - 4.6 release series: https://github.com/gnocchixyz/gnocchi/commit/0672fc6a40319e5d632d727afa6aaa5031651ff5 credits: swdb references: links: - description: This OSSN url: https://docs.openstack.org/security-notes/OSSN-0112.html - description: GitHub Advisory url: https://github.com/gnocchixyz/gnocchi/security/advisories/GHSA-cjq3-6hm7-q33w author: Tobias Urdin (Binero)
Hello, Bug #1150009 in gnocchi reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/gnocchi/-/commit/60500fa3b65f83e3631f925b22f9cd8695a86fce ------------------------------------------------------------------------ * OSSN-0112: Improper Access Control through /metric/v1/metric via POST parameter "resource_id". Added patch: "Enforce update resource policy metric creation" (Closes: #1150009): - OSSN-0112_Enforce-update-resource-policy-metric-creation-st....patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1150009
Hello, Bug #1150009 in gnocchi reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/gnocchi/-/commit/6b71ccddada5193882b0e494d316732b9467e79f ------------------------------------------------------------------------ * OSSN-0112: Improper Access Control through /metric/v1/metric via POST parameter "resource_id". Added patch: "Enforce update resource policy metric creation" (Closes: #1150009): - OSSN-0112_Enforce-update-resource-policy-metric-creation-st....patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1150009
Hello, Bug #1150009 in gnocchi reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/gnocchi/-/commit/a27024b44c8adce647e79fdb072764066f575b8a ------------------------------------------------------------------------ * OSSN-0112: Improper Access Control through /metric/v1/metric via POST parameter "resource_id". Added patch: "Enforce update resource policy metric creation" (Closes: #1150009): - OSSN-0112_Enforce-update-resource-policy-metric-creation-st....patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1150009
Hello, Bug #1150009 in gnocchi reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/gnocchi/-/commit/5a017aef537189f1d28f927216b52b2f2d1dc614 ------------------------------------------------------------------------ * OSSN-0112: Improper Access Control through /metric/v1/metric via POST parameter "resource_id". Added patch: "Enforce update resource policy metric creation" (Closes: #1150009): - OSSN-0112_Enforce-update-resource-policy-metric-creation-st....patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1150009
Hello, Bug #1150009 in gnocchi reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/gnocchi/-/commit/19c4849cd7cadd8c20473cd1494aab21ad9257bf ------------------------------------------------------------------------ * OSSN-0112: Improper Access Control through /metric/v1/metric via POST parameter "resource_id". Added patch: "Enforce update resource policy metric creation" (Closes: #1150009): - OSSN-0112_Enforce-update-resource-policy-metric-creation-st....patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1150009
Hello, Bug #1150009 in gnocchi reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/gnocchi/-/commit/79e8786bf3468486f80526f6999dff8a1500c9ab ------------------------------------------------------------------------ * OSSN-0112: Improper Access Control through /metric/v1/metric via POST parameter "resource_id". Added patch: "Enforce update resource policy metric creation" (Closes: #1150009): - OSSN-0112_Enforce-update-resource-policy-metric-creation-st....patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1150009
Hello, Bug #1150009 in gnocchi reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/gnocchi/-/commit/215577d555648d0be6767e8f8ca1d37961542462 ------------------------------------------------------------------------ * OSSN-0112: Improper Access Control through /metric/v1/metric via POST parameter "resource_id". Added patch: "Enforce update resource policy metric creation" (Closes: #1150009): - OSSN-0112_Enforce-update-resource-policy-metric-creation-st....patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1150009
Hello, Bug #1150009 in gnocchi reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/gnocchi/-/commit/693c84fc2652d7791431931bc3a17685f440754a ------------------------------------------------------------------------ * OSSN-0112: Improper Access Control through /metric/v1/metric via POST parameter "resource_id". Added patch: "Enforce update resource policy metric creation" (Closes: #1150009): - OSSN-0112_Enforce-update-resource-policy-metric-creation-st....patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1150009
Hello, Bug #1150009 in gnocchi reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/gnocchi/-/commit/40a0aac7e100353e796947b0e04b223a10382487 ------------------------------------------------------------------------ * OSSN-0112: Improper Access Control through /metric/v1/metric via POST parameter "resource_id". Added patch: "Enforce update resource policy metric creation" (Closes: #1150009): - OSSN-0112_Enforce-update-resource-policy-metric-creation-st....patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1150009
We believe that the bug you reported is fixed in the latest version of
gnocchi, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 1150009@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thomas Goirand <zigo@debian.org> (supplier of updated gnocchi package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 05 Oct 2026 11:40:33 +0200
Source: gnocchi
Architecture: source
Version: 4.7.0-7
Distribution: unstable
Urgency: high
Maintainer: Debian OpenStack <team+openstack@tracker.debian.org>
Changed-By: Thomas Goirand <zigo@debian.org>
Closes: 1150009
Changes:
gnocchi (4.7.0-7) unstable; urgency=high
.
* Removed add-header = Connection: close from gnocchi-api-uwsgi.ini.
* OSSN-0112: Improper Access Control through /metric/v1/metric via POST
parameter "resource_id". Added patch: "Enforce update resource policy
metric creation" (Closes: #1150009):
- OSSN-0112_Enforce-update-resource-policy-metric-creation-st....patch
* Add fix-test-discovery-without-proton.patch.
Checksums-Sha1:
62e768913032b59148486e0350bddfe1b191b8c2 3530 gnocchi_4.7.0-7.dsc
58115808cfe4594691f760020bbcf01481d8853d 15976 gnocchi_4.7.0-7.debian.tar.xz
8922e8016772a7cc27bdfb27c6458e152da27f65 17461 gnocchi_4.7.0-7_amd64.buildinfo
Checksums-Sha256:
aa38612d1a8fad32e4f7b25e84d8a19341057e42a23c0552fd6dd663f9936a0c 3530 gnocchi_4.7.0-7.dsc
c02c4d33c9a6afc2ac866641a84aa48723e0cd886a25c99454eb057ea82ad635 15976 gnocchi_4.7.0-7.debian.tar.xz
8407e52bee45e4b24a91addd8504de82a6f54cd31f8d59ec564f69f781928a97 17461 gnocchi_4.7.0-7_amd64.buildinfo
Files:
b2132a7bdd43a3e0af179b0e73145d3e 3530 net optional gnocchi_4.7.0-7.dsc
e63a865381860b51e29cd154b54e8e00 15976 net optional gnocchi_4.7.0-7.debian.tar.xz
c25407d56e914a6eebf8348a7b11d62e 17461 net optional gnocchi_4.7.0-7_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmrDcR4ACgkQ1BatFaxr
Q/6E9w//ZN7qPXICs1fQJDYASh7DgsKIvBsY17CTyzkT+GBD0ydeXWgf07THYCu9
T6bpit/qpQ7jhmzo7YEy+tQzqWS8zlGi9fXL7CWbvaTro/gHOZCH0GXH6lrd2rLx
lxtd38bTPjOev/dPOtpfkpux1f5OSr2Ez3oBk92oIk02idibnKUuZLz82cyGomkf
aKXhbMr9xSZ8Ngz33qt1/BOgKColUSGhP8cd7c/oLvaF/7nAGPvAggcetS7RY3so
groMJ45EuzzkDZ3eQynDn+y7swCKQOPVgX4s70ViFyKQmZWwlXzztPAMEdA+ZgP0
GoU6ADnTVCpv7hw/JghgXNqEQGxZlRZo6mejKj9/bly9aKKSn6iW54Kbaotqo6dT
e8tspbMh5D/IyY9OXadPlQKKaerDHctYo6UcX0ArJkx4xtD1eP5dNQGBboC+t/8n
anS2331WUE9DZjkU9vKJSOfWccB2CxfstfMb1HKegG/76at35Wm2p1VEfuAllJbP
rZ9BzgTeIjnrcdYrGG9x7aCXUxGu4tEjkoSIpJQRiImm7F2ugCw3sjs5QSQYEAnM
NWbsCEu62jdjRY0XOSSeNs1Q0XkjQ8m8Cys30iOHCS3lHkkO5+ZZt/8ypD1K0ctY
o2TtZlBfJfPYTBRcsN+F5xjHScfZ0W3DgkWc0BbBIip71+OnzOk=
=HhuL
-----END PGP SIGNATURE-----