Critical Security Flaws in Performance Co-Pilot (PCP) Packages: Command Injection and Privilege Escalation
Summary
ALSA-2026:55560: Important: pcp security update. Affects pcp-conf versions < 5.3.7-22.el8_10.5. Fixed in 5.3.7-22.el8_10.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Performance Co-Pilot (PCP) is a suite of tools, services, and libraries designed for the acquisition, archiving, and analysis of system-level performance measurements. Its lightweight distributed architecture makes it particularly effective for centralized analysis of complex systems. However, recent vulnerabilities have raised concerns about its security, particularly regarding the linux_sockets PMDA and pmproxy components.
Vulnerability Detail
The vulnerabilities identified in PCP include arbitrary command execution via command injection (CVE-2026-16524), privilege escalation to root through the linux_sockets PMDA (CVE-2026-16526), unauthenticated access to the /store endpoint allowing bypassing pmcd access rules (CVE-2026-16527), and denial of service due to signed integer overflow (CVE-2026-16529). These vulnerabilities can lead to severe security breaches, allowing attackers to execute arbitrary commands, gain unauthorized access, or disrupt service availability.
How To Fix
Minimum fixed version
5.3.7-22.el8_10.5
This is the first release that contains the fix.
sudo dnf update pcp-confTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the /store endpoint and limit the use of the linux_sockets PMDA until the packages are updated. Additionally, consider implementing network security measures to mitigate the risk of unauthorized access.
Conclusion
The vulnerabilities in Performance Co-Pilot (PCP) pose significant security risks, including command injection and privilege escalation. It is crucial to update the affected packages to the latest patched version to safeguard your systems. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for pcp-conf →
FAQ
The vulnerabilities include command injection, privilege escalation, unauthenticated access, and denial of service.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without signup.
Consequences include unauthorized command execution, privilege escalation to root, and service disruption, which can severely impact system security and availability.
Yes, a patch is available in version 5.3.7-22.el8_10.5. Updating to this version will resolve the vulnerabilities.
Implement access restrictions to vulnerable components and enhance network security to mitigate risks until you can apply the updates.
