Critical Security Flaw in pcs Package: Arbitrary Code Execution Vulnerability
Summary
ALSA-2026:10713: Important: pcs security update. Affects cockpit-ha-cluster versions < 0.12.1-1.el10_1.3. Fixed in 0.12.1-1.el10_1.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pcs package is a command-line configuration tool designed for managing the Pacemaker and Corosync utilities, which are essential for high-availability clustering in Linux environments. This package allows system administrators to configure and manage cluster resources effectively. However, it has been found to be vulnerable to a significant security issue that could allow arbitrary code execution through untrusted input, particularly in template imports.
Vulnerability Detail
The vulnerability identified as CVE-2026-4800 affects the lodash library used within the pcs package. This flaw arises from improper handling of untrusted input, which can lead to arbitrary code execution. Attackers could exploit this vulnerability to execute malicious code on the affected system, potentially compromising sensitive data and system integrity. The vulnerability is particularly concerning in environments where pcs is used to manage critical infrastructure, as it could lead to severe operational disruptions.
How To Fix
Minimum fixed version
0.12.1-1.el10_1.3
This is the first release that contains the fix.
sudo dnf update cockpit-ha-clusterTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the pcs command-line tool to trusted administrators only, minimizing the risk of exploitation until the package is updated. Additionally, consider disabling any features that utilize the vulnerable lodash library until a patch is applied.
Conclusion
The pcs package has a critical vulnerability (CVE-2026-4800) that allows for arbitrary code execution due to improper handling of untrusted input in the lodash library. Users are strongly advised to update to the latest patched version to safeguard their systems. Until then, implementing workarounds can help mitigate potential risks.
See every vulnerability recorded for cockpit-ha-cluster →
FAQ
CVE-2026-4800 is a vulnerability in the lodash library used by the pcs package, allowing for arbitrary code execution through untrusted input.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
Exploitation of this vulnerability could lead to unauthorized code execution, data breaches, and significant disruptions in high-availability environments.
It is recommended to regularly check for updates and apply security patches as soon as they are available to mitigate vulnerabilities.
If immediate updates are not possible, implement access restrictions and disable vulnerable features until a patch can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for cockpit-ha-cluster.
