Critical Security Flaw in Performance Co-Pilot (PCP) Leading to Command Execution and Privilege Escalation
Summary
ALSA-2026:55617: Important: pcp security update. Affects pcp versions < 7.0.3-5.el10_2. Fixed in 7.0.3-5.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Performance Co-Pilot (PCP) is a suite of tools, services, and libraries designed for the acquisition, archiving, and analysis of system-level performance measurements. Its lightweight distributed architecture is particularly suited for centralized analysis of complex systems, making it a vital component in performance monitoring. However, recent vulnerabilities have exposed critical security flaws that could be exploited by malicious actors.
Vulnerability Detail
The vulnerabilities identified in PCP include arbitrary command execution via command injection (CVE-2026-16524), privilege escalation to root through the linux_sockets PMDA (CVE-2026-16526), unauthenticated access to the /store endpoint allowing bypassing of pmcd access rules (CVE-2026-16527), and denial of service due to signed integer overflow (CVE-2026-16529). These vulnerabilities can lead to severe consequences, including unauthorized access to sensitive data, system compromise, and service disruptions.
How To Fix
Minimum fixed version
7.0.3-5.el10_2
This is the first release that contains the fix.
sudo dnf update pcpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, restrict access to the /store endpoint and ensure that only authenticated users can access sensitive functionalities. Additionally, monitor system logs for any unauthorized access attempts.
Conclusion
The vulnerabilities in Performance Co-Pilot (PCP) pose significant risks to system security, including potential command execution and privilege escalation. It is crucial to update to the patched version and implement necessary security measures to mitigate these risks.
See every vulnerability recorded for pcp →
FAQ
The vulnerabilities can lead to unauthorized command execution, privilege escalation, and denial of service, potentially compromising the entire system.
You can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application without needing to sign up.
Implement access controls and monitor logs for suspicious activities as a temporary workaround until you can apply the updates.
Yes, there are known exploits that can leverage these vulnerabilities for command execution and privilege escalation.
Regularly check for updates and vulnerabilities, ideally on a weekly basis, to ensure your software remains secure.
Related vulnerabilities
Recent vulnerabilities recorded for pcp.
