Access Control Bypass Vulnerability in PCP Product by Red Hat
CVE-2026-16527
7.3HIGH
Key Information:
What is CVE-2026-16527?
An unauthenticated remote attacker can exploit a vulnerability in the PCP pmproxy /store endpoint by sending specially crafted requests. This exploit allows the attacker to bypass existing access controls, enabling them to overwrite any PMDA metric. The result is arbitrary code execution, which can lead to a complete system takeover, posing significant security risks for affected users.
Affected Version(s)
Red Hat Enterprise Linux 10 0:7.0.3-5.el10_2
Red Hat Enterprise Linux 10.0 Extended Update Support 0:6.3.7-1.el10_0.1
Red Hat Enterprise Linux 8 0:5.3.7-22.el8_10.5