Critical Security Update for pcs and pcs-snmp Packages: Red Hat Advisory RHSA-2026:84843
Summary
RHSA-2026:84843: Red Hat Security Advisory: pcs security update. Affects pcs versions < 0:0.10.8-1.el8_4.12. Fixed in 0:0.10.8-1.el8_4.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pcs (Pacemaker/Corosync) package is a high-availability cluster management tool for Linux systems, allowing users to manage cluster resources and configurations. The pcs-snmp package extends this functionality by providing SNMP support for monitoring cluster status. Both packages are essential for maintaining high availability in enterprise environments, but they are currently vulnerable to security issues that could compromise system integrity.
Vulnerability Detail
The vulnerability identified in the pcs and pcs-snmp packages is associated with CVE-2024-14029 and CVE-2026-82397. This security flaw could allow unauthorized access or manipulation of cluster configurations, potentially leading to service disruptions or data loss. The vulnerability arises from insufficient validation of input data, which could be exploited by an attacker to execute arbitrary commands or gain elevated privileges within the system.
How To Fix
Minimum fixed version
0:0.10.8-1.el8_4.12
This is the first release that contains the fix.
sudo dnf update pcsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to restrict access to the pcs and pcs-snmp services until the packages can be updated. This can be done by modifying firewall rules or using access control lists to limit exposure to trusted networks only.
Conclusion
In summary, the pcs and pcs-snmp packages are vulnerable to critical security issues that could impact the integrity of high-availability clusters. It is crucial to update these packages to the latest patched version to mitigate risks. Users are encouraged to utilize tools like Vulert for ongoing monitoring of vulnerabilities.
See every vulnerability recorded for pcs →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
Failure to address this vulnerability could lead to unauthorized access, data loss, or service disruptions in your high-availability cluster.
Yes, you need to update to version 0:0.10.8-1.el8_4.12 to ensure that the vulnerability is patched.
Vulert is a service that monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json. It helps ensure your applications remain secure.
Related vulnerabilities
Recent vulnerabilities recorded for pcs.
