In OpenStack Aodh versions prior to 22.0.1, the alarm list API incorrectly checks only for the presence of the all_projects parameter rather than its value. When all_projects is set to false, the API removes the key and skips the branch that restricts alarm listings to the caller's project, allowing non-admin users with reader roles to view alarms across all projects. This exposes alarm actions containing sensitive data such as trust webhook URLs and project/user identifiers. Furthermore, OpenStack Watcher's webhook trigger endpoint has lacked authorization enforcement since its introduction in the Ussuri release (Watcher 4.0.0), allowing any authenticated user who obtains a webhook URL to initiate audits and associated action plans without proper permission checks.

Non-administrative users with reader roles can bypass project scoping to access alarms from all projects, leading to exposure of sensitive alarm metadata including webhook URLs and project/user identifiers. This information disclosure can facilitate unauthorized triggering of audits and action plans via OpenStack Watcher's unauthenticated webhook endpoint, potentially impacting the integrity and confidentiality of cloud operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the alarm list API and monitor usage of the all_projects parameter. Limit knowledge and distribution of webhook URLs to trusted users only. Review and enforce strict access controls on OpenStack Watcher's webhook trigger endpoint to prevent unauthorized triggering of audits.