2026.1 Series Release Notes¶

22.0.1-1¶

Bug #2167496: Fixed an authorization bypass in the alarm listing API where repeated project_id query filters made the authorization check operate on the first value while the storage query filtered on the last one, allowing a non-admin user to list another project’s alarms, including their action URLs. Repeated query fields are now rejected with HTTP 400.

Bug #2161276: Fixed a vulnerability where passing all_projects=false in alarm queries bypassed project scope filtering. Previously, the presence of all_projects in the query caused the project scoping logic to be skipped entirely, allowing non-admin users to list alarms from all projects. Queries with all_projects=false or without all_projects now correctly restrict results to the caller’s project.

Prometheus queries for nonadmin users or for admin users who specify a particular project are now being restricted to that project or to the nonadmin user’s current project. Admins can still create alarms for resources across multiple projects without restrictions. This works similarly to how gnocchi alarms work for some time already. Use the [DEFAULT].prometheus_project_label_name configuration option to configure label name used for distinguishing between projects.

The aodh-config-generator command has been deprecated and will be removed in a futrue release.