CVE-2026-84828 in Red Hat
Summary
by MITRE • 09/10/2026
A flaw was found in PCS (Pacemaker Configuration System). A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read with root privileges by the pcsd daemon and can be exfiltrated by the attacker through subsequent cluster node communication. This allows disclosure of sensitive data such as API keys, tokens, or configuration secrets that would otherwise be inaccessible to the attacker.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
The Pacemaker Configuration System, commonly referred to as PCS, serves as a critical management interface for high-availability Linux clusters. It facilitates the configuration and maintenance of cluster resources by interacting with the pcsd daemon running on each node. A significant security vulnerability has been identified within this system that allows for unauthorized file disclosure through an improper access control mechanism. The flaw specifically affects the 'pcs host auth --token' command, which is designed to authenticate a user against a specific cluster node using a token-based authentication method. Under normal operational circumstances, this command should validate credentials and establish a secure session without exposing underlying system files. However, due to insufficient validation of input parameters or improper handling of file paths within the execution context of the pcsd daemon, an attacker can manipulate this command to read arbitrary files from the local filesystem.
The technical nature of this vulnerability stems from how the pcsd daemon processes requests originating from users who are members of the 'haclient' group. This group is typically granted elevated privileges necessary for managing cluster configurations, but it should not inherently possess root-level access to sensitive system files outside of specific, controlled operations. The vulnerability allows a local attacker with membership in this group to exploit the authentication mechanism by supplying crafted input that causes the daemon to read arbitrary file contents rather than performing standard authentication checks. A critical constraint of this exploitation vector is that the targeted file must be shorter than 256 bytes. This length limitation suggests that the flaw may involve buffer handling or a specific parsing logic in the token processing routine where oversized inputs are rejected, but smaller inputs containing malicious paths are processed with root privileges.
The operational impact of this vulnerability is severe because it results in an unauthorized disclosure of sensitive information. Since the pcsd daemon executes file reads with root-level permissions, any file accessible to the root user can potentially be read by the attacker if it meets the size constraint. This capability enables the exfiltration of highly confidential data such as API keys, authentication tokens, database credentials, and other configuration secrets stored on disk. The attack chain typically involves reading the sensitive file via the vulnerable command and then transmitting this data to an external server or another node within the cluster through subsequent communication channels available to the attacker. This effectively bypasses standard operating system permission models, allowing a lower-privileged user to escalate their access indirectly by stealing credentials that belong to higher-privilege accounts or services.
From a classification perspective, this vulnerability aligns with CWE-200: Information Exposure and CWE-732: Incorrect Permission Assignment for Critical Resource. The failure lies in the incorrect assignment of permissions where resources intended for administrative use are accessible via an interface not properly restricted to those specific administrative actions. In terms of attack tactics, this behavior is consistent with ATT&CK technique T1504: Weak or Hardcoded Cryptographic Key if sensitive keys are exposed, and more broadly falls under Initial Access vectors involving valid accounts that have been compromised or misconfigured. The ability to read files as root represents a significant escalation from standard user-level access, effectively granting the attacker full control over any secrets stored in those locations.
Mitigation strategies should focus on both immediate remediation and long-term architectural improvements. The primary solution is to apply vendor-provided patches that address the input validation logic within the pcsd daemon's handling of the 'pcs host auth' command. Administrators must ensure that PCS software is updated to versions where this specific path traversal or buffer overflow issue has been resolved. In addition to patching, organizations should review and restrict membership in the 'haclient' group, applying the principle of least privilege by ensuring only essential administrators have these rights. Furthermore, implementing strict file system permissions on sensitive configuration files can provide a defense-in-depth layer; even if an attacker exploits this vulnerability, restrictive umask settings or mandatory access control policies like SELinux could prevent root-level reads from succeeding. Regular auditing of cluster node communications and monitoring for unusual data exfiltration patterns related to authentication events are also recommended to detect potential exploitation attempts early.