A flaw in PCS (Pacemaker Configuration System) allows a local attacker with 'haclient' group membership to use the 'pcs host auth --token' command to read arbitrary files under 256 bytes on the filesystem. The pcsd daemon, running as root, reads these files and the attacker can exfiltrate the contents through cluster node communication. This vulnerability affects PCS versions from 0.10.8 onwards, including those shipped with Red Hat Enterprise Linux 8.4+, 9.0+, and 10.0+ High Availability add-on. The vulnerability is rated moderate severity due to required local access, privileged group membership, and limited file size for disclosure. The attacker cannot modify files or escalate privileges beyond reading sensitive data.

The vulnerability allows local attackers with 'haclient' group membership to read sensitive files up to 256 bytes in size with root privileges, potentially exposing confidential data such as API keys, tokens, or configuration secrets. There is no impact on integrity or availability, and the attacker cannot modify files or escalate privileges beyond the existing group membership. Exploitation requires local access and valid cluster management credentials.

No official patch or fix is currently confirmed. Mitigation focuses on restricting membership of the 'haclient' group to trusted users who require cluster management access. Administrators should audit and remove unnecessary accounts from this group to reduce exposure. This mitigation reduces risk but does not eliminate it for legitimate 'haclient' members. Monitor Red Hat advisories for updates on patches or fixes.