Executive brief
PCS (Pacemaker Configuration System) is a management tool for high-availability Linux clusters. A local attacker with membership in the 'haclient' group can exploit a flaw in the 'pcs host auth --token' command to read arbitrary files up to 256 bytes in size, including API keys, tokens, and configuration secrets. The attacker leverages the pcsd daemon running as root to access files they shouldn't normally have permission to read, then exfiltrate the contents through cluster communication.
Technical details
The vulnerability is an incorrect permission assignment (CWE-732) in PCS versions 0.10.8 and later. A local attacker with 'haclient' group membership can invoke the 'pcs host auth --token' command to read arbitrary filesystem files up to 256 bytes, with the pcsd daemon executing the read operation as root. The pcsd daemon then communicates with cluster nodes, allowing the attacker to exfiltrate the file contents through subsequent cluster node communication. Attack vector is local and requires low privilege (haclient group membership), with no user interaction needed. This is limited to files under 256 bytes and does not allow file modification. A fix is available via upstream commit 9178b78d11baa70e700a5c0d9fc1c17f27d452fa.
Affected products
- Red Hat PCS 0.10.8 and later
- Red Hat Red Hat Enterprise Linux 8.4+, 9.0+, 10.0+
Timeline
- 2026-09-10: disclosed
- other: Patched via upstream commit 9178b78d11baa70e700a5c0d9fc1c17f27d452fa