Bug 2527320 (CVE-2026-84828)

Summary:	CVE-2026-84828 pcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --token
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, dpaolell, eglynn, jdelft, jjoyce, jpretori, jschluet, jupierce, lgarciaa, lhh, mbiarnes, mburns, mgarciac, ppalepu, ppostler, prdhamdh, rhel-process-autobot, security-response-team, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in PCS (Pacemaker Configuration System). A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read with root privileges by the pcsd daemon and can be exfiltrated by the attacker through subsequent cluster node communication. This allows disclosure of sensitive data such as API keys, tokens, or configuration secrets that would otherwise be inaccessible to the attacker.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-02 11:22:01 UTC

PCS (Pacemaker Configuration System) has an arbitrary file read vulnerability in the `pcs host auth --token <path>` command path. When a non-root user in the 'haclient' group runs this command, the `_non_root_run()` function in `pcs/app.py` forwards it to the locally running pcsd daemon via HTTP POST to `/run_pcs`. The pcsd daemon (running as root) matches the command against its allowed_commands list in `pcsd/pcsd.rb` (`['host', 'auth', '...']`) with no restriction on `--token`, and re-executes PCS as root. This causes `utils.get_token_from_file()` in `pcs/utils.py` to open and read the attacker-specified file path with root privileges, reading up to 256 bytes. The file contents are base64-encoded and stored as a token in the known-hosts configuration file. The attacker can exfiltrate the file contents by triggering node communication (e.g., `pcs pcsd status`) and intercepting the HTTP Cookie header containing the base64-encoded token.

Affected: PCS versions from 0.10.8 onwards (introduced in commit 9178b78d11baa70e700a5c0d9fc1c17f27d452fa). RHEL 8.4+, RHEL 9.0+, and RHEL 10.0+ ship affected PCS versions.

Fix: Upstream patch attached to PSIRTSUPT-22935 (commit b41eaf3c6e2ecfc575c42442fb02b8ef05b4dd6a, not yet on public GitHub main). Blocks `pcs host auth --token` for non-root users in both `pcs/app.py` and `pcsd/pcsd.rb`.

Reporter: Peter Romancik (PCS upstream developer, Red Hat).
PSIRT ticket: PSIRTSUPT-22935