Critical Security Update for Pacemaker: CVE-2026-10649 Vulnerability
Summary
RHSA-2026:42076: Red Hat Security Advisory: pacemaker security update. Affects pacemaker versions < 0:2.1.2-4.el8_6.11. Fixed in 0:2.1.2-4.el8_6.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pacemaker is a high-availability cluster resource manager that enables the management of cluster resources and ensures that services remain available even in the event of a failure. It is widely used in enterprise environments to maintain service uptime and reliability. The recent vulnerability identified as CVE-2026-10649 poses a significant risk to systems utilizing Pacemaker, particularly those running on Red Hat Enterprise Linux 8.6.
Vulnerability Detail
The vulnerability CVE-2026-10649 in Pacemaker allows for potential unauthorized access and manipulation of cluster resources. This could lead to service disruptions, unauthorized data access, or even complete system compromise. The vulnerability originates from insufficient validation of user input, which can be exploited by attackers to execute arbitrary commands within the cluster environment. The CVSS score for this vulnerability is 8.6, indicating a high severity level.
How To Fix
Minimum fixed version
0:2.1.2-4.el8_6.11
This is the first release that contains the fix.
sudo dnf update pacemakerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the Pacemaker service and monitor logs for any suspicious activity until the patch can be applied. Additionally, disabling unnecessary features of Pacemaker that may expose the system to this vulnerability can help mitigate risks.
Conclusion
The CVE-2026-10649 vulnerability in Pacemaker presents a serious risk to systems relying on this critical resource manager. It is imperative to apply the available patches promptly to safeguard against potential exploits. Users are encouraged to utilize tools like Vulert to monitor their applications for vulnerabilities effectively.
See every vulnerability recorded for pacemaker →
FAQ
CVE-2026-10649 is a security vulnerability found in the Pacemaker package that allows unauthorized access and manipulation of cluster resources.
The vulnerability has a CVSS score of 8.6, indicating a high severity level that could lead to significant security risks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot apply the patch immediately, consider implementing temporary workarounds such as restricting access to the Pacemaker service and monitoring for suspicious activity.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using just a manifest file like package-lock.json. More information can be found at https://vulert.com.
Related vulnerabilities
Recent vulnerabilities recorded for pacemaker.
