Critical Security Flaw in pcs and pcs-snmp Packages: Arbitrary Code Execution Risk
Summary
ALSA-2026:19167: Important: pcs security update. Affects pcs versions < 0.11.11-2.el9_8.1. Fixed in 0.11.11-2.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pcs (Pacemaker Configuration System) package provides a command-line interface for configuring the Pacemaker and Corosync utilities, which are essential for managing high-availability clusters. The pcs-snmp package extends this functionality by enabling SNMP monitoring of cluster resources. Both packages are widely used in enterprise environments to ensure system reliability and uptime. However, a recently identified vulnerability exposes these packages to arbitrary code execution through untrusted input, posing significant security risks.
Vulnerability Detail
The vulnerability, identified as CVE-2026-4800, arises from the use of the lodash library within the pcs and pcs-snmp packages. This flaw allows attackers to execute arbitrary code by exploiting template imports that process untrusted input. If successfully exploited, this vulnerability could lead to unauthorized access, data breaches, or complete system compromise, making it critical for users to address it promptly.
How To Fix
Minimum fixed version
0.11.11-2.el9_8.1
This is the first release that contains the fix.
sudo dnf update pcsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the pcs and pcs-snmp utilities until the packages are updated. This can be done by modifying user permissions or disabling the services that rely on these packages.
Conclusion
In summary, the pcs and pcs-snmp packages are vulnerable to a critical security flaw that allows for arbitrary code execution. Users are strongly advised to update to the latest patched versions to protect their systems from potential attacks. Regular monitoring and timely updates are essential for maintaining security in software environments.
See every vulnerability recorded for pcs →
FAQ
CVE-2026-4800 is a security vulnerability in the pcs and pcs-snmp packages that allows for arbitrary code execution via untrusted input in template imports.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Failure to address this vulnerability could lead to unauthorized access, data breaches, or complete system compromise, putting sensitive information at risk.
It is recommended to regularly check for updates and apply security patches as soon as they are released to mitigate risks associated with vulnerabilities.
Vulert is a service that monitors and alerts users in real-time for open-source vulnerabilities in software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for pcs.
