[Debian-ha-maintainers] Bug#1147515: pcs: CVE-2026-84828

[Salvatore Bonaccorso]

Source: pcs
Version: 0.10.8-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for pcs.

Unfortunately according to the Red Hat bug, the commit referenced is
not yet public? 

CVE-2026-84828[0]:
| A flaw was found in PCS (Pacemaker Configuration System). A local
| attacker with membership in the 'haclient' group can exploit the
| 'pcs host auth --token' command to read the contents of arbitrary
| files on the filesystem, provided the files are shorter than 256
| bytes. The file contents are read with root privileges by the pcsd
| daemon and can be exfiltrated by the attacker through subsequent
| cluster node communication. This allows disclosure of sensitive data
| such as API keys, tokens, or configuration secrets that would
| otherwise be inaccessible to the attacker.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-84828
    https://www.cve.org/CVERecord?id=CVE-2026-84828
[1] https://bugzilla.redhat.com/show_bug.cgi?id=2527320

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore