OSSN-0109: Cross-project metric association bypass in Gnocchi (2026-10-07)

Summary

The Gnocchi metric creation endpoint allows authenticated users to associate metrics with resources owned by others by passing resource_id in the request body bypassing proper authorization checks.

This improper access control enables attackers to inject arbitrary measures into resources, squat on metric names, and trigger downstream actions including Aodh alarms and Heat scaling policies across project boundaries.

Affected Services / Software

  • Gnocchi (<4.6.6, ==4.7.0)

Discussion

The Gnocchi API did not apply any policy when passing resource_id in the request body when creating metrics using POST /v1/metric.

This allowed an attacker to create metrics for another project’s resources if the resource UUID was known or could be enumerated.

The attacker can push measures to this metric potentially affecting Aodh alarms and thus Heat scaling policies that could trigger stack changes that causes changes in OpenStack resources on the project.

The attacker can use this to squat on metric names, other members in the project cannot delete metrics created by the attacker due to (correct) policy enforcement.

This vulnerability was originally disclosed by gnocchi’s upstream at https://github.com/gnocchixyz/gnocchi.

Contacts / References

Author: Tobias Urdin (Binero)