Bug 2506031 (CVE-2026-16527) - CVE-2026-16527 PCP: PCP pmproxy: Unauthenticated access to /store endpoint allows bypassing pmcd access rules
Summary: CVE-2026-16527 PCP: PCP pmproxy: Unauthenticated access to /store endpoint al...
Keywords:
Status: NEW
Alias: CVE-2026-16527
Deadline: 2026-07-30
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2511441
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-22 07:36 UTC by OSIDB Bzimport
Modified: 2026-10-01 22:52 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:55560 0 None None None 2026-08-17 10:32:49 UTC
Red Hat Product Errata RHSA-2026:55617 0 None None None 2026-08-17 19:46:29 UTC
Red Hat Product Errata RHSA-2026:55740 0 None None None 2026-08-17 19:41:05 UTC
Red Hat Product Errata RHSA-2026:72272 0 None None None 2026-09-28 04:58:17 UTC
Red Hat Product Errata RHSA-2026:72273 0 None None None 2026-09-28 04:02:29 UTC
Red Hat Product Errata RHSA-2026:72593 0 None None None 2026-09-28 15:14:40 UTC
Red Hat Product Errata RHSA-2026:72594 0 None None None 2026-09-28 15:13:22 UTC
Red Hat Product Errata RHSA-2026:73767 0 None None None 2026-09-30 07:56:28 UTC
Red Hat Product Errata RHSA-2026:74612 0 None None None 2026-10-01 22:52:32 UTC
Red Hat Product Errata RHSA-2026:74613 0 None None None 2026-10-01 22:45:51 UTC

Description OSIDB Bzimport 2026-07-22 07:36:48 UTC 
Summary: The pmproxy REST API exposes a /store endpoint writing to any PMDA metric
via pmStore() without authentication. Two authentication flags (-S for credential
requirements, -Q for client certificate) exist as case blocks in the source but are absent from
the short_options string and longopts table, making both code paths permanently dead and
impossible to activate. Combined with an unrestricted hostspec parameter, an
unauthenticated HTTP attacker can force pmproxy to connect to pmcd via Unix socket,
bypassing all pmcd [access] host rules that cover only IPv4 and IPv6 transports.
Prerequisites: pmproxy running and reachable on default port 44322. pmcd running.
linux_sockets PMDA loaded (required for the full RCE chain with Vulnerability 3).
Comment 1 errata-xmlrpc 2026-08-17 10:32:48 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:55560 https://access.redhat.com/errata/RHSA-2026:55560
Comment 2 errata-xmlrpc 2026-08-17 19:41:04 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:55740 https://access.redhat.com/errata/RHSA-2026:55740
Comment 3 errata-xmlrpc 2026-08-17 19:46:28 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:55617 https://access.redhat.com/errata/RHSA-2026:55617
Comment 4 Jon Orris 2026-09-28 04:02:28 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:72273 https://access.redhat.com/errata/RHSA-2026:72273
Comment 5 Jon Orris 2026-09-28 04:58:16 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:72272 https://access.redhat.com/errata/RHSA-2026:72272
Comment 6 Jon Orris 2026-09-28 15:13:21 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:72594 https://access.redhat.com/errata/RHSA-2026:72594
Comment 7 Jon Orris 2026-09-28 15:14:39 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:72593 https://access.redhat.com/errata/RHSA-2026:72593
Comment 8 Jon Orris 2026-09-30 07:56:27 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:73767 https://access.redhat.com/errata/RHSA-2026:73767
Comment 10 Jon Orris 2026-10-01 22:45:49 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:74613 https://access.redhat.com/errata/RHSA-2026:74613
Comment 11 Jon Orris 2026-10-01 22:52:31 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:74612 https://access.redhat.com/errata/RHSA-2026:74612
Note You need to log in before you can comment on or make changes to this bug.