UBUNTU-CVE-2026-84828

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-84828
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-84828.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-84828
Upstream
Published
2026-09-11T00:00:00Z
Modified
2026-09-11T20:53:44Z
Severity
  • Ubuntu - medium
Summary
[none]
Details

A flaw was found in PCS (Pacemaker Configuration System). A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read with root privileges by the pcsd daemon and can be exfiltrated by the attacker through subsequent cluster node communication. This allows disclosure of sensitive data such as API keys, tokens, or configuration secrets that would otherwise be inaccessible to the attacker.

References

Affected packages

Ubuntu:Pro:22.04:LTS / pcs

Package

Name
pcs
Purl
pkg:deb/ubuntu/pcs?arch=source&distro=esm-apps%2Fjammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.10.8-1ubuntu1
0.10.11-2ubuntu2
0.10.11-2ubuntu3
0.10.11-2ubuntu3+esm1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "pcs",
            "binary_version": "0.10.11-2ubuntu3+esm1"
        },
        {
            "binary_name": "pcs-snmp",
            "binary_version": "0.10.11-2ubuntu3+esm1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-84828.json"

Ubuntu:24.04:LTS / pcs

Package

Name
pcs
Purl
pkg:deb/ubuntu/pcs?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.11.6-1ubuntu1
0.11.7-1ubuntu1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "pcs",
            "binary_version": "0.11.7-1ubuntu1"
        },
        {
            "binary_name": "pcs-snmp",
            "binary_version": "0.11.7-1ubuntu1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-84828.json"

Ubuntu:26.04:LTS / pcs

Package

Name
pcs
Purl
pkg:deb/ubuntu/pcs?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.12.1-2ubuntu1
0.12.1-2ubuntu3

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "pcs",
            "binary_version": "0.12.1-2ubuntu3"
        },
        {
            "binary_name": "pcs-snmp",
            "binary_version": "0.12.1-2ubuntu3"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-84828.json"