CVE-2026-84828

Name	CVE-2026-84828
Description	A flaw was found in PCS (Pacemaker Configuration System). A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read with root privileges by the pcsd daemon and can be exfiltrated by the attacker through subsequent cluster node communication. This allows disclosure of sensitive data such as API keys, tokens, or configuration secrets that would otherwise be inaccessible to the attacker.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
pcs (PTS)	bookworm	0.11.5-1+deb12u1	vulnerable
	trixie	0.12.0.2-1	vulnerable
	forky, sid	0.12.3-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
pcs	source	(unstable)	(unfixed)

Notes

https://bugzilla.redhat.com/show_bug.cgi?id=2527320
Introduced with: https://github.com/ClusterLabs/pcs/commit/9178b78d11baa70e700a5c0d9fc1c17f27d452fa (0.10.8)
Fixed by: https://github.com/ClusterLabs/pcs/commit/b41eaf3c6e2ecfc575c42442fb02b8ef05b4dd6a
update once upstream commit public/accessible, cf. Red Hat bug