2026.1 Series Release Notes¶

22.0.1¶

Bug #2161276: Fixed a vulnerability where passing all_projects=false in alarm queries bypassed project scope filtering. Previously, the presence of all_projects in the query caused the project scoping logic to be skipped entirely, allowing non-admin users to list alarms from all projects. Queries with all_projects=false or without all_projects now correctly restrict results to the caller’s project.

Prometheus queries for nonadmin users or for admin users who specify a particular project are now being restricted to that project or to the nonadmin user’s current project. Admins can still create alarms for resources across multiple projects without restrictions. This works similarly to how gnocchi alarms work for some time already. Use the [DEFAULT].prometheus_project_label_name configuration option to configure label name used for distinguishing between projects.

The aodh-config-generator command has been deprecated and will be removed in a futrue release.