Critical Security Flaw in Performance Co-Pilot (PCP) Packages: Command Injection and Privilege Escalation Vulnerabilities
Summary
ALSA-2026:55740: Important: pcp security update. Affects pcp versions < 6.3.7-8.el9_8.4. Fixed in 6.3.7-8.el9_8.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Performance Co-Pilot (PCP) is a suite of tools, services, and libraries designed for the acquisition, archiving, and analysis of system-level performance measurements. Its lightweight distributed architecture is particularly suited for centralized analysis of complex systems, making it a valuable tool for system administrators and developers. However, recent vulnerabilities have been identified that could compromise the security of systems utilizing PCP.
Vulnerability Detail
The vulnerabilities in PCP include arbitrary command execution via command injection (CVE-2026-16524), privilege escalation to root through a vulnerability in the linux_sockets PMDA (CVE-2026-16526), unauthenticated access to the /store endpoint allowing bypassing pmcd access rules (CVE-2026-16527), and a denial of service due to signed integer overflow (CVE-2026-16529). These vulnerabilities could allow attackers to execute arbitrary commands, gain elevated privileges, access sensitive data, or disrupt service availability.
How To Fix
Minimum fixed version
6.3.7-8.el9_8.4
This is the first release that contains the fix.
sudo dnf update pcpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, restrict access to the affected services and endpoints until the packages can be updated. Implement firewall rules to limit access to the /store endpoint and monitor system logs for any suspicious activity.
Conclusion
The identified vulnerabilities in the Performance Co-Pilot (PCP) packages pose significant risks to system security, including command injection and privilege escalation. It is crucial to update to the patched version to mitigate these risks and ensure the integrity of the system.
See every vulnerability recorded for pcp →
FAQ
The command injection vulnerability allows attackers to execute arbitrary commands on the system, potentially leading to data breaches or system compromise.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without any signup.
If immediate updates are not possible, implement strict access controls and monitor for any unusual activity until the updates can be applied.
Yes, there are known exploits for these vulnerabilities, particularly for command injection and privilege escalation, making it critical to apply the patches as soon as possible.
Failure to address these vulnerabilities could result in unauthorized access, data loss, service disruption, and significant security breaches.
Related vulnerabilities
Recent vulnerabilities recorded for pcp.
