DEBIAN-CVE-2026-84828

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-84828
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-84828.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-84828
Upstream
Published
2026-09-10T12:16:33Z
Modified
2026-09-15T09:03:18Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

A flaw was found in PCS (Pacemaker Configuration System). A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read with root privileges by the pcsd daemon and can be exfiltrated by the attacker through subsequent cluster node communication. This allows disclosure of sensitive data such as API keys, tokens, or configuration secrets that would otherwise be inaccessible to the attacker.

References

Affected packages

Debian:12 / pcs

Package

Name
pcs
Purl
pkg:deb/debian/pcs?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.11.5-1
0.11.5-1+deb12u1
0.11.6-1
0.11.6-2
0.11.7-1
0.11.7-2
0.11.7-3
0.11.9-1
0.12.0-1
0.12.0-2
0.12.0.2-1
0.12.1-1
0.12.1-2
0.12.2-1
0.12.2-2
0.12.3-1
0.12.3.1-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-84828.json"

Debian:13 / pcs

Package

Name
pcs
Purl
pkg:deb/debian/pcs?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.12.0.2-1
0.12.1-1
0.12.1-2
0.12.2-1
0.12.2-2
0.12.3-1
0.12.3.1-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-84828.json"

Debian:14 / pcs

Package

Name
pcs
Purl
pkg:deb/debian/pcs?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.12.0.2-1
0.12.1-1
0.12.1-2
0.12.2-1
0.12.2-2
0.12.3-1
0.12.3.1-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-84828.json"