CVE-2026-84828
Received Received - Intake

Local File Read in Pacemaker Configuration System

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: redhat-SADP

Description
A flaw was found in PCS (Pacemaker Configuration System). A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read with root privileges by the pcsd daemon and can be exfiltrated by the attacker through subsequent cluster node communication. This allows disclosure of sensitive data such as API keys, tokens, or configuration secrets that would otherwise be inaccessible to the attacker.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-84828
EUVD
EUVD-2026-75396

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
red_hat pcs From 0.10.8 (inc)
red_hat pcs From 8.4 (inc)
red_hat pcs From 9.0 (inc)
red_hat pcs From 10.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-732 The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an arbitrary file read flaw in PCS (Pacemaker Configuration System). A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read files up to 256 bytes long on the filesystem. The pcsd daemon reads these files with root privileges and the contents are exfiltrated through cluster node communication.

Detection Guidance

Check if any user in the 'haclient' group has executed the 'pcs host auth --token' command. Review logs for pcsd daemon activity, particularly HTTP POST requests involving token handling. Inspect known-hosts configuration files for unexpected base64-encoded content under 256 bytes.

Impact Analysis

An attacker could access sensitive data such as API keys, tokens, or configuration secrets stored in files. This requires local access, membership in the 'haclient' group, and a multi-step exfiltration process. The impact is limited by the 256-byte file size constraint.

Mitigation Strategies

Remove unnecessary users from the 'haclient' group. Apply the upstream fix by updating PCS to a patched version. Monitor for suspicious pcsd daemon activity or unauthorized file reads. Restrict access to cluster management tools to only trusted administrators.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84828. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart