DEBIAN-CVE-2026-84828
A flaw was found in PCS (Pacemaker Configuration System). A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read with root privileges by the pcsd daemon and can be exfiltrated by the attacker through subsequent cluster node communication. This allows disclosure of sensitive data such as API keys, tokens, or configuration secrets that would otherwise be inaccessible to the attacker.
DEBIAN-CVE-2026-84828
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-84828
pcs
Source reference: /affected/0/package/name
- Affected versions
- 0.11.5-1
Source reference:
/affected/0/versions0.11.5-1+deb12u1Source reference:
/affected/0/versions0.11.6-1Source reference:
/affected/0/versions0.11.6-2Source reference:
/affected/0/versions0.11.7-1Source reference:
/affected/0/versions0.11.7-2Source reference:
/affected/0/versions0.11.7-3Source reference:
/affected/0/versions0.11.9-1Source reference:
/affected/0/versions0.12.0-1Source reference:
/affected/0/versions0.12.0-2Source reference:
/affected/0/versions0.12.0.2-1Source reference:
/affected/0/versions0.12.1-1Source reference:
/affected/0/versions0.12.1-2Source reference:
/affected/0/versions0.12.2-1Source reference:
/affected/0/versions0.12.2-2Source reference:
/affected/0/versions0.12.3-1Source reference:
/affected/0/versions0.12.3.1-1Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
pcs
Source reference: /affected/1/package/name
- Affected versions
- 0.12.0.2-1
Source reference:
/affected/1/versions0.12.1-1Source reference:
/affected/1/versions0.12.1-2Source reference:
/affected/1/versions0.12.2-1Source reference:
/affected/1/versions0.12.2-2Source reference:
/affected/1/versions0.12.3-1Source reference:
/affected/1/versions0.12.3.1-1Source reference:
/affected/1/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
pcs
Source reference: /affected/2/package/name
- Affected versions
- 0.12.0.2-1
Source reference:
/affected/2/versions0.12.1-1Source reference:
/affected/2/versions0.12.1-2Source reference:
/affected/2/versions0.12.2-1Source reference:
/affected/2/versions0.12.2-2Source reference:
/affected/2/versions0.12.3-1Source reference:
/affected/2/versions - Fixed versions
- 0.12.3.1-1
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "pcs",
"purl": "pkg:deb/debian/pcs?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"0.11.5-1",
"0.11.5-1+deb12u1",
"0.11.6-1",
"0.11.6-2",
"0.11.7-1",
"0.11.7-2",
"0.11.7-3",
"0.11.9-1",
"0.12.0-1",
"0.12.0-2",
"0.12.0.2-1",
"0.12.1-1",
"0.12.1-2",
"0.12.2-1",
"0.12.2-2",
"0.12.3-1",
"0.12.3.1-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-84828.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "pcs",
"purl": "pkg:deb/debian/pcs?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"0.12.0.2-1",
"0.12.1-1",
"0.12.1-2",
"0.12.2-1",
"0.12.2-2",
"0.12.3-1",
"0.12.3.1-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-84828.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.12.3.1-1"
}
]
}
],
"package": {
"name": "pcs",
"purl": "pkg:deb/debian/pcs?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"0.12.0.2-1",
"0.12.1-1",
"0.12.1-2",
"0.12.2-1",
"0.12.2-2",
"0.12.3-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-84828.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #58513 · Revision 1
- Added to Heist Feed
- Publisher date