Bug 2506031 (CVE-2026-16527) - CVE-2026-16527 PCP: PCP pmproxy: Unauthenticated access to /store endpoint allows bypassing pmcd access rules
Summary: CVE-2026-16527 PCP: PCP pmproxy: Unauthenticated access to /store endpoint al...
Keywords:
Status: NEW
Alias: CVE-2026-16527
Deadline: 2026-07-30
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2511441
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-22 07:36 UTC by OSIDB Bzimport
Modified: 2026-08-17 19:46 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:55560 0 None None None 2026-08-17 10:32:49 UTC
Red Hat Product Errata RHSA-2026:55617 0 None None None 2026-08-17 19:46:29 UTC
Red Hat Product Errata RHSA-2026:55740 0 None None None 2026-08-17 19:41:05 UTC

Description OSIDB Bzimport 2026-07-22 07:36:48 UTC 
Summary: The pmproxy REST API exposes a /store endpoint writing to any PMDA metric
via pmStore() without authentication. Two authentication flags (-S for credential
requirements, -Q for client certificate) exist as case blocks in the source but are absent from
the short_options string and longopts table, making both code paths permanently dead and
impossible to activate. Combined with an unrestricted hostspec parameter, an
unauthenticated HTTP attacker can force pmproxy to connect to pmcd via Unix socket,
bypassing all pmcd [access] host rules that cover only IPv4 and IPv6 transports.
Prerequisites: pmproxy running and reachable on default port 44322. pmcd running.
linux_sockets PMDA loaded (required for the full RCE chain with Vulnerability 3).
Comment 1 errata-xmlrpc 2026-08-17 10:32:48 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:55560 https://access.redhat.com/errata/RHSA-2026:55560
Comment 2 errata-xmlrpc 2026-08-17 19:41:04 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:55740 https://access.redhat.com/errata/RHSA-2026:55740
Comment 3 errata-xmlrpc 2026-08-17 19:46:28 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:55617 https://access.redhat.com/errata/RHSA-2026:55617
Note You need to log in before you can comment on or make changes to this bug.