CVE-2026-16527 in Red Hat
Summary
by MITRE • 07/30/2026
An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability represents a critical access control bypass in the Performance Co-Pilot pmproxy component that affects the /store endpoint functionality. The flaw exists within the authentication mechanism where unauthenticated requests can manipulate the proxy service to accept and process malicious data submissions without proper verification of the sender's identity or authorization status. The vulnerability stems from insufficient input validation and authentication checks within the PCP framework, specifically targeting the pmproxy daemon which serves as a gateway for performance data collection and management.
The technical implementation of this vulnerability allows an attacker to craft specially formatted requests that exploit a weakness in how the /store endpoint processes incoming data. When these crafted requests are sent to the pmproxy service, they can bypass existing access control mechanisms and gain unauthorized write permissions to PMDA (Performance Metrics Domain Architecture) metrics within the system. This represents a direct violation of the principle of least privilege and demonstrates a fundamental flaw in the permission model that governs metric modification operations.
The operational impact of this vulnerability extends far beyond simple data manipulation, as it provides attackers with the capability to execute arbitrary code on the target system and ultimately achieve complete system takeover. By overwriting PMDA metrics, an attacker can inject malicious data into the performance monitoring infrastructure, potentially corrupting system integrity and creating backdoor access points. This type of attack aligns with attack patterns documented in the ATT&CK framework under initial access and privilege escalation techniques, where adversaries leverage service vulnerabilities to gain unauthorized system control.
Security implications are particularly severe given that PCP is widely deployed across enterprise environments for system monitoring and performance management purposes. The vulnerability affects systems where pmproxy is exposed to untrusted networks or where proper network segmentation has not been implemented. This makes it especially dangerous in cloud environments, containerized deployments, or any scenario where the proxy service operates without adequate network boundary controls. The vulnerability can be exploited remotely without requiring prior authentication credentials, making it particularly attractive to automated attack tools.
The root cause of this issue can be mapped to CWE-285, which addresses improper authorization within software systems, and CWE-347, which covers improper verification of cryptographic signatures or certificates. These weaknesses enable the bypass of intended access controls and allow unauthorized modification of system resources. Organizations should implement immediate mitigations including network segmentation to restrict access to pmproxy endpoints, deployment of firewall rules to limit exposure, and configuration of proper authentication mechanisms for the proxy service.
Recommended remediation strategies include applying vendor patches as soon as available, implementing strict access control policies that require authentication for all /store endpoint operations, and conducting thorough network audits to identify all exposed instances of pmproxy. Additionally, monitoring should be enhanced to detect unusual patterns in performance metric modifications, which could indicate exploitation attempts. The vulnerability demonstrates the critical importance of proper input validation and authentication in security-critical services, particularly those that serve as gateways for system monitoring data flows. Organizations should also consider implementing network-based intrusion detection systems to monitor for suspicious requests targeting the affected endpoints and establish incident response procedures specifically addressing performance monitoring infrastructure compromises.