VulnerabilityPublished 10 Sep 2026Updated 14 Sep 2026

CVE-2026-84828: Red Hat Enterprise Linux 10 · Incorrect Permissions

Affects Red Hat Enterprise Linux 10Source CVE Database V5

Not known to be exploited · CVSS 6.5 Medium.

Data as of 26 Oct 2026, 10:12 UTC

CVSS 3.1 base score

6.5Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS

0.1% chance of exploitation in 30 days – higher than 3% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-09-14.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector: Local
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Scope: Changed
Confidentiality: High
Integrity: None
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Local: The vulnerable component is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or remotely (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., tricking a legitimate user into opening a malicious document).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: Low: The attacker is authorized with (i.e., requires) privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges may have the ability to cause an impact only to non-sensitive resources.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Changed: An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 10 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
Red Hat Enterprise Linux 10pcs	Affected–	Fixed in–
Red Hat Enterprise Linux 8pcs	Affected–	Fixed in–
Red Hat Enterprise Linux 9pcs	Affected–	Fixed in–
Red Hat OpenShift Container Platform 4openshift/ose-rhel-coreos-9	Affected–	Fixed in–
Red Hat OpenStack Platform 16.2rhosp-rhel8/openstack-base	Affected–	Fixed in–
Red Hat OpenStack Platform 17.1rhosp-rhel9/openstack-frr	Affected–	Fixed in–

AI-suggested

Restrict membership in the 'haclient' group to trusted users who require cluster management access. Audit and remove any unnecessary accounts from the 'haclient' group to reduce exposure. Monitor the Red Hat advisory for any future patch releases.

Description

CVE-2026-84828 is a vulnerability in the Pacemaker Configuration System (PCS) component of Red Hat Enterprise Linux 10 and other versions. A local attacker who is a member of the 'haclient' group can exploit the 'pcs host auth --token' command to read arbitrary files on the filesystem, limited to files smaller than 256 bytes. The pcsd daemon reads these files with root privileges and the attacker can exfiltrate the data through cluster node communication. This vulnerability allows disclosure of sensitive information such as API keys and tokens that would normally be inaccessible.

Impact

The vulnerability allows local attackers with 'haclient' group membership to read sensitive files with root privileges, limited to files under 256 bytes. This can lead to disclosure of sensitive data such as API keys, tokens, or configuration secrets that would otherwise be inaccessible. There is no impact on integrity or availability. Exploitation requires local access and privileged group membership, limiting the attack surface. The multi-step exfiltration path and file size limitation constrain the practical impact.

Summary

This vulnerability affects PCS versions from 0.10.8 onwards, including those shipped with Red Hat Enterprise Linux 8.4+, 9.0+, and 10.0+ as part of the High Availability add-on. A local attacker with 'haclient' group membership can use the 'pcs host auth --token' command to read the contents of arbitrary files smaller than 256 bytes. The pcsd daemon, running as root, performs the file read, enabling privilege escalation in terms of data access. The attacker can then exfiltrate this data via cluster communication channels. Exploitation requires local access, membership in the privileged 'haclient' group, and involves a multi-step exfiltration process. The vulnerability is rated moderate severity with a CVSS 3.1 base score of 6.5, reflecting high confidentiality impact but no integrity or availability impact.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 09:05 UTC

Technical details

References

Community reviews

Related threats