As per subject. Full bug report upstream here: https://storyboard.openstack.org/#!/story/2011933 which even includes a reproducer. Patch is currently being worked on (by me). First patch here: https://review.opendev.org/c/openstack/heat/+/1015427 Cheers, Thomas Goirand (zigo)
Hello, Bug #1153846 in heat reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/heat/-/commit/3d6114669ad3e8d7f60eb7d6547b690d20d55e3b ------------------------------------------------------------------------ sb-2011933: stack-user credentials could signal arbitrary resources of any stack in the project. Applied patch Enforce stack-user binding on resource_signal (Closes: #1153846): - sb-2011933_Enforce_stack-user_binding_on_resource_signal.patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1153846
Hello, Bug #1153846 in heat reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/heat/-/commit/2c554c3ef125d6951156a88c8c70c475841c8507 ------------------------------------------------------------------------ sb-2011933: stack-user credentials could signal arbitrary resources of any stack in the project. Applied patch Enforce stack-user binding on resource_signal (Closes: #1153846): - sb-2011933_Enforce_stack-user_binding_on_resource_signal.patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1153846
Hello, Bug #1153846 in heat reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/heat/-/commit/9354f9fae1cd30a7bd2e457fb858fbdcdbde60df ------------------------------------------------------------------------ sb-2011933: stack-user credentials could signal arbitrary resources of any stack in the project. Applied patch Enforce stack-user binding on resource_signal (Closes: #1153846): - sb-2011933_Enforce_stack-user_binding_on_resource_signal.patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1153846
Hello, Bug #1153846 in heat reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/heat/-/commit/1afd2b073a2c1f448458209cd85f238b7e9abf38 ------------------------------------------------------------------------ sb-2011933: stack-user credentials could signal arbitrary resources of any stack in the project. Applied patch Enforce stack-user binding on resource_signal (Closes: #1153846): - sb-2011933_Enforce_stack-user_binding_on_resource_signal.patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1153846
Hello, Bug #1153846 in heat reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/heat/-/commit/41fd2045123a2083353ead49f8da41a28d6aa35a ------------------------------------------------------------------------ sb-2011933: stack-user credentials could signal arbitrary resources of any stack in the project. Applied patch Enforce stack-user binding on resource_signal (Closes: #1153846): - sb-2011933_Enforce_stack-user_binding_on_resource_signal.patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1153846
We believe that the bug you reported is fixed in the latest version of
heat, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 1153846@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thomas Goirand <zigo@debian.org> (supplier of updated heat package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Wed, 04 Nov 2026 00:48:11 +0100
Source: heat
Architecture: source
Version: 1:27.0.0-5
Distribution: unstable
Urgency: high
Maintainer: Debian OpenStack <team+openstack@tracker.debian.org>
Changed-By: Thomas Goirand <zigo@debian.org>
Closes: 1153846
Changes:
heat (1:27.0.0-5) unstable; urgency=high
.
* sb-2011933: stack-user credentials could signal arbitrary resources of
any stack in the project. Applied patch Enforce stack-user binding on
resource_signal (Closes: #1153846):
- sb-2011933_Enforce_stack-user_binding_on_resource_signal.patch
Checksums-Sha1:
db93909db31dad9bf3aea1749b2b204c02b3fea4 4014 heat_27.0.0-5.dsc
3e8c7f460a68f01ea9477fb57352706754492254 24700 heat_27.0.0-5.debian.tar.xz
8bd6da85f4d7d79b3a746a13fbe6b5d3361731ac 17721 heat_27.0.0-5_amd64.buildinfo
Checksums-Sha256:
fff8f43e70f6ac22763c17d6ae74a1e329a1e318fc8bd884a52fa575601f5bc9 4014 heat_27.0.0-5.dsc
07b86a4cd043ff3b2e0cf149703a0740aee48fa094e64ec4424af69c92b3ecd3 24700 heat_27.0.0-5.debian.tar.xz
c016c28d32031f4a866f65138f13944152ec9a6517ffbe6b6a1dcfdf4b61dfb6 17721 heat_27.0.0-5_amd64.buildinfo
Files:
466091f46de739e4d39a1696046b9a7d 4014 web optional heat_27.0.0-5.dsc
8395e8435b13f4e3cba303c867148b81 24700 web optional heat_27.0.0-5.debian.tar.xz
e1713b944d511c73d612d6a57b950c3f 17721 web optional heat_27.0.0-5_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmr2E04ACgkQ1BatFaxr
Q/5ubQ//amuXnTvknkj3yQnWkp8cp2ZfI0x854E/MkUd+5R0b1pJu/GoH2hD3S/p
GEAYp9mtZdiy7/LlKaV0RcrTkvF8Ir0yHv1FVQCP9FA2KCRPRfbIxVkE5SrLmu44
i5hsfFr++FXXGeNQp+y04EwbkAZOfyzSpZx83FnAt2REOKD85ecMyhRC+q4mBNVi
0TgBVw+tG5ZnKr4V6aBHfQejOJKm5/B64pqeU68DHXdWRcC1gjc+nP0a8s3nlWBZ
SVZDaCrxCo6wlwu5ximDbQmAy5LdlRd24+hiw8JW0d9neL8TwuAoRxG3nFHiW1Cz
FLEIMtbi7dXU89bWpXvuyuo2IzKoSRGSRar1+5chO9IM5oPx0YA3SZqe3/FBvKlC
xMthIbtQZStM7Tv03DDgydajTv8L50P7HkBR5TOWORw+w8H3p1xcK4st1KzVPM4E
fyLCOI6+Zyx6OdThj6tUyLwT5P4diM56LgBhA194E7C4k6ZdFLoRagsXFEneg6GC
NZ8rbbfkCLSB/HdUgRK7Hbc/WdE8X4GXEeZc/58NdqJtfE94npgTtni0nRVXyX4J
9sU40wN5zRbtO6JtT8aRWBP9wibHFn90Jd7FdVG+2P4iRbHWwiAQzAAKQ4zRXL3k
qW6U3D5gcxDjmHuRLCpirqR7EXtXqv+5uhmD3qStDXbMOvGz6X8=
=ZF5i
-----END PGP SIGNATURE-----
Hello, Bug #1153846 in heat reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/heat/-/commit/4dee9c62c5ba49e5a65b6c36f0dbf5a9e770b1a2 ------------------------------------------------------------------------ sb-2011933: stack-user credentials could signal arbitrary resources of any stack in the project. Applied patch Enforce stack-user binding on resource_signal (Closes: #1153846): - sb-2011933_Enforce_stack-user_binding_on_resource_signal.patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1153846
Hello, Bug #1153846 in heat reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/heat/-/commit/0ced70ea650fbdf1a107bbe2340edc4f1c6235b9 ------------------------------------------------------------------------ sb-2011933: stack-user credentials could signal arbitrary resources of any stack in the project. Applied patch Enforce stack-user binding on resource_signal (Closes: #1153846): - sb-2011933_Enforce_stack-user_binding_on_resource_signal.patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1153846