Critical Security Flaw in pcs and pcs-snmp Packages: Arbitrary Code Execution Risk
Summary
ALSA-2026:10710: Important: pcs security update. Affects pcs versions < 0.11.10-1.el9_7.3. Fixed in 0.11.10-1.el9_7.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pcs package provides a command-line configuration system for managing Pacemaker and Corosync utilities, which are essential for high-availability clustering in Linux environments. The pcs-snmp package extends this functionality by enabling SNMP monitoring of cluster resources. Both packages are integral to ensuring reliable service uptime, but they have been found vulnerable to a significant security issue that could allow arbitrary code execution through untrusted input.
Vulnerability Detail
The vulnerability, identified as CVE-2026-4800, arises from the use of lodash in the pcs packages. This flaw allows attackers to execute arbitrary code by exploiting untrusted input during template imports. If successfully executed, this could lead to unauthorized access, data breaches, or complete system compromise, making it critical for users to address this vulnerability promptly.
How To Fix
Minimum fixed version
0.11.10-1.el9_7.3
This is the first release that contains the fix.
sudo dnf update pcsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of the pcs and pcs-snmp packages by restricting access to the configuration system and monitoring tools until the packages are updated. Additionally, avoid using untrusted input in template imports until the patch is applied.
Conclusion
The pcs and pcs-snmp packages are critical for managing high-availability clusters in Linux. The discovery of CVE-2026-4800 highlights the importance of maintaining up-to-date software to prevent arbitrary code execution vulnerabilities. Users are strongly encouraged to apply the available patch and monitor their systems for any signs of exploitation.
See every vulnerability recorded for pcs →
FAQ
CVE-2026-4800 is a security vulnerability in the pcs and pcs-snmp packages that allows arbitrary code execution via untrusted input in template imports.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to systems, potential data breaches, and the ability for attackers to execute arbitrary code, which could lead to severe security incidents.
Yes, a patch is available. Users should update to version 0.11.10-1.el9_7.3 of the pcs and pcs-snmp packages to mitigate the risk.
If immediate updates are not possible, restrict access to the affected packages and avoid using untrusted input in template imports as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for pcs.
