Is CVE-2026-84828 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84828 being exploited in the wild.

How severe is CVE-2026-84828?

Medium severity, with a CVSS score of 6.5, published 10 September 2026.

Which products and versions are affected?

Red Hat PCS 0.10.8 and later; Red Hat Enterprise Linux 8.4+, 9.0+, 10.0+.

Is there a fix for CVE-2026-84828?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-84828 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-84828?

Check whether you run Red Hat PCS or Red Hat Enterprise Linux at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84828: PCS arbitrary file read via pcs host auth --token

CVE-2026-84828 · Severity: medium · CVSS 6.5 · Published 2026-09-10

PCS (Pacemaker Configuration System) is a management tool for high-availability Linux clusters. A local attacker with membership in the 'haclient' group can exploit a flaw in the 'pcs host auth --token' command to read arbitrary files up to 256 bytes in size, including API keys, tokens, and configuration secrets. The attacker leverages the pcsd daemon running as root to access files they shouldn't normally have permission to read, then exfiltrate the contents through cluster communication.

Technologies: Red Hat Enterprise Linux. Vendors: Red Hat.

Quick answers

Is CVE-2026-84828 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84828 being exploited in the wild.
How severe is CVE-2026-84828?: Medium severity, with a CVSS score of 6.5, published 10 September 2026.
Which products and versions are affected?: Red Hat PCS 0.10.8 and later; Red Hat Enterprise Linux 8.4+, 9.0+, 10.0+.
Is there a fix for CVE-2026-84828?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-84828 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-84828?: Check whether you run Red Hat PCS or Red Hat Enterprise Linux at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an incorrect permission assignment (CWE-732) in PCS versions 0.10.8 and later. A local attacker with 'haclient' group membership can invoke the 'pcs host auth --token' command to read arbitrary filesystem files up to 256 bytes, with the pcsd daemon executing the read operation as root. The pcsd daemon then communicates with cluster nodes, allowing the attacker to exfiltrate the file contents through subsequent cluster node communication. Attack vector is local and requires low privilege (haclient group membership), with no user interaction needed. This is limited to files under 256 bytes and does not allow file modification. A fix is available via upstream commit 9178b78d11baa70e700a5c0d9fc1c17f27d452fa.

Affected products

Red Hat PCS 0.10.8 and later
Red Hat Red Hat Enterprise Linux 8.4+, 9.0+, 10.0+

Timeline

2026-09-10: disclosed
other: Patched via upstream commit 9178b78d11baa70e700a5c0d9fc1c17f27d452fa

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.