2026.2 Series Release Notes¶

23.0.0-3¶

Bug #2167496: Fixed an authorization bypass in the alarm listing API where repeated project_id query filters made the authorization check operate on the first value while the storage query filtered on the last one, allowing a non-admin user to list another project’s alarms, including their action URLs. Repeated query fields are now rejected with HTTP 400.

The following options are no longer loaded from the [DEFAULT] section. Use the [api] section instead.
- user_alarm_quota
- project_alarm_quota
- alarm_max_actions

The deprecated [DEFAULT] event_alarm_topuc option has been removed. Use the [listener] event_alarm_topuc option instead.

The following deprecated options have been removed.
- [service_credentials] os_region_name: Use [service_credentials] region_name instead.
- [service_credentials] os_endpoint_type: Use [service_credentials] interface instead.
- [service_credentials] os_cacert and [DEFAULT] os_cacert: Use [service_credentials] cacert instead.

The deprecated [oslo_policy] enforce_scope configuration option has been removed in oslo.policy version 6.0.0 which will impact Keystone as there is no longer any way to disable RBAC policy scope enforcement; scope checks are now always enforced regardless of configuration.

If you are not upgrading the oslo.policy to 6.0.0, then there will not be any change in scope enforcement behaviour.

The deprecated [DEFAULT] heartbeat option has been removed. Use the [DEFAULT] heartbeat_interval option instead.

Bug #2161276: Fixed a vulnerability where passing all_projects=false in alarm queries bypassed project scope filtering. Previously, the presence of all_projects in the query caused the project scoping logic to be skipped entirely, allowing non-admin users to list alarms from all projects. Queries with all_projects=false or without all_projects now correctly restrict results to the caller’s project.

Fixed SRBAC policy definitions to align with the OpenStack-wide consistent and secure RBAC goal. The project admin persona has been removed in favor of the legacy non-project admin, and all policy rules now use project_member_or_admin or project_reader_or_admin composites so that legacy admin tokens continue to work alongside scoped project personas. The alarm creation endpoint now correctly retrieves the target project for policy enforcement.