-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 12 Aug 2026 10:12:23 +0200 Source: watcher Architecture: source Version: 16.0.0-5 Distribution: unstable Urgency: high Maintainer: Debian OpenStack <team+openstack@tracker.debian.org> Changed-By: Thomas Goirand <zigo@debian.org> Closes: 1144880 Changes: watcher (16.0.0-5) unstable; urgency=high . * CVE-2026-XXXXX / OSSA-2026-036: Watcher webhook trigger endpoint does not enforce oslo.policy authorization. Any authenticated user who learns a Watcher audit webhook URL can POST to the webhook to trigger an administrator-owned EVENT audit and its associated action plan, regardless of the caller's project or role. The webhook endpoint has lacked policy enforcement since its introduction in the Ussuri release. Applied upstream patch: "Add policy enforcement to webhook trigger endpoint". (Closes: #1144880) Checksums-Sha1: babfd42fa7d69d2e8e78b8d09a6b1ac5e634dbb3 3673 watcher_16.0.0-5.dsc d503a26e19df3172959805da4b698cb749722cff 13604 watcher_16.0.0-5.debian.tar.xz 532cf284ac4a9383a4db997dd7acfac609fb9b07 18221 watcher_16.0.0-5_amd64.buildinfo Checksums-Sha256: 6f9ae7c7e1d8b7ba0d1245411f1baa9934516c5efdaea495a0c445224c8542c5 3673 watcher_16.0.0-5.dsc ebb90a6e83e0ded19ed088c2363cb701cbfb0d9c0b26eaa91d39bba877b83cbc 13604 watcher_16.0.0-5.debian.tar.xz d0111b8457523022d6857effb03656eeb8c8639133be5a3d4f273e3add726c0a 18221 watcher_16.0.0-5_amd64.buildinfo Files: 9a4450550f65f9600d7c4ffb390a4623 3673 net optional watcher_16.0.0-5.dsc a0eef9198409b05b8de8adefcf5d4ce9 13604 net optional watcher_16.0.0-5.debian.tar.xz 4c4a6a09bb2750b3b592479f51e7f73d 18221 net optional watcher_16.0.0-5_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmqGFTYACgkQ1BatFaxr Q/6Yxw//aNw6kuFHNTUx1yePVdqjjPEegJv8WVJoFmjJqBJazrGRxOUN/ZySrwv3 FTWV8v/oJspaY/9z9EWnx4xXILLeJgY6luAx2HUTt7ZPG8HSi+51kceMrfU8WCTN VtvW7VDC+mUmvTMupOY+2Rg5RWSSzDL6BoWQfEOfdmZCGsg8Nlr6hRCdvX3teF2W 2SShjU5Zgi9os1xTvJTOTKezLnXCnKI0Ixa6kF2DjQryKrZDcx8mwY7SSyhq3IZy Siay+LoDbNGyPKhjziQBmpCAVylpvzgp672GTKxheYPUxwcVy9b8fX5P0UCy8/in Uplqfptep5A8kyNO4zYiReEVCdgsCwo46sKUMSAp4MOrVmTzRIlVaajhFFTrRT4N IzHKyURbb4zVZBhU+SmX6jCNpC0udqMUjGncRAyy/yWc8L0SUw7IJbkPsa10BTfb aeu/nixrTgRbggcvCx5RUMuMWu/CRbTbYWmPmyBvaxqeu9If0rbnBnRZm6Rwn6B1 da2NJxJbkFzA9Z8A9Rq+KcNC2EOhc3uDI67xOtzbX9TMTYBgb/KWMXmqHVJZUg8a wLYzKAQU26Fkbd3cvS2yl6h8NLhY0N89GYqbcJVEnecWoTObsvbQnb+HXyKrBnPu rdvE42JiFS3RKn8wl6U8KBO9If9b+aWxE5SQgUmACKpw3q/B0Vk= =Wh2/ -----END PGP SIGNATURE-----
