Critical Security Update for Pacemaker: CVE-2026-10649
Summary
RHSA-2026:43606: Red Hat Security Advisory: pacemaker security update. Affects pacemaker versions < 0:1.1.23-1.el7_9.2. Fixed in 0:1.1.23-1.el7_9.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pacemaker is a high-availability cluster resource manager that enables the management of cluster resources and services. It is widely used in enterprise environments to ensure that critical applications remain available and operational. The package includes various components such as pacemaker-cli, pacemaker-cluster-libs, and pacemaker-remote, which collectively provide robust clustering capabilities. However, a recently identified vulnerability (CVE-2026-10649) poses significant risks to users of these packages, necessitating immediate attention.
Vulnerability Detail
The vulnerability identified as CVE-2026-10649 affects multiple components of the Pacemaker package, allowing unauthorized access and potential manipulation of cluster resources. This flaw arises from inadequate input validation, which could enable an attacker to exploit the system, leading to service disruptions or unauthorized control over critical applications. The CVSS score for this vulnerability is 8.6, indicating a high severity level that requires prompt remediation to protect enterprise environments.
How To Fix
Minimum fixed version
0:1.1.23-1.el7_9.2
This is the first release that contains the fix.
sudo dnf update pacemakerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the Pacemaker services and monitor logs for any suspicious activity until the update can be applied. Additionally, implementing network-level security measures such as firewalls can help mitigate potential exploitation.
Conclusion
The CVE-2026-10649 vulnerability in the Pacemaker package poses significant risks to enterprise environments. Users are strongly advised to update their packages to the patched version 0:1.1.23-1.el7_9.2 to mitigate these risks. Implementing temporary workarounds can provide additional security until the update is applied.
See every vulnerability recorded for pacemaker →
FAQ
CVE-2026-10649 is a security vulnerability affecting the Pacemaker package that could allow unauthorized access and manipulation of cluster resources.
The vulnerability has a CVSS score of 8.6, indicating a high severity level that requires immediate attention.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate updating is not possible, implement access restrictions and monitor for suspicious activity as a temporary workaround.
More information can be found in the Red Hat Security Advisory and on the Vulert website, which provides tools for monitoring open-source vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for pacemaker.
