Skip to main content
CVE-2026-4800VulnerabilityPublished Updated

Red Hat Security Advisory: pcs security update

Affects Red Hat pcsSource GCVE Database

0
Compare

Not known to be exploited : upgrade Red Hat pcs to 10.1.3 or 9.7.3 soon.

Data as of 29 Oct 2026, 19:04 UTC

Severity
High

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS
2.8% chance of exploitation in 30 days – higher than 86% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch
Available – fixed in 10.1.3, 9.7.3

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 29 Apr 2026

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponized: evidence found.

    Public exploit code: GitHub proofs of concept

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), GitHub proofs of concept, the Metasploit, Exploit-DB and nuclei-templates index as of 29 Oct 2026.

What to do

Upgrade Red Hat pcs to 10.1.3 or 9.7.3.

Affected software

ProductAffectedFixed in
Red Hat Product Security Red HatAffected
  • >=9.0.0 <9.7.3
  • >=10.0.0 <10.1.3
  • Red Hat
  • Red Hat Enterprise Linux
  • Red Hat Enterprise Linux High Availability (v. 9)
  • Red Hat Enterprise Linux Resilient Storage (v. 9)
  • src
  • Red Hat Enterprise Linux High Availability (v. 10)
  • noarch
  • cockpit-ha-cluster-0:0.12.1-1.el10_1.3.noarch
  • Red Hat Enterprise Linux High Availability E4S (v.9.2)
  • Red Hat Enterprise Linux Resilient Storage E4S (v.9.2)
  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Enterprise Linux BaseOS (v. 9)
  • Red Hat Enterprise Linux High Availability EUS (v. 10.0)
  • cockpit-ha-cluster-0:0.12.0-3.el10_0.5.noarch
  • Red Hat Enterprise Linux High Availability EUS (v.9.6)
  • Red Hat Enterprise Linux Resilient Storage EUS (v.9.6)
  • Red Hat Enterprise Linux High Availability EUS (v.9.4)
  • Red Hat Enterprise Linux Resilient Storage EUS (v.9.4)
  • cockpit-ha-cluster-0:0.12.2-3.el10_2.1.noarch
  • SUSE
  • x86_64
  • pcs-0:0.11.9-2.el9_6.4.x86_64
  • pcs-snmp-0:0.11.9-2.el9_6.4.x86_64
  • SUSE Linux Enterprise
Fixed in
  • 9.7.3
  • 10.1.3

AI-suggested

Red Hat has released official patches for this vulnerability in updated pcs packages for Red Hat Enterprise Linux versions 9 and 10, including High Availability and Resilient Storage variants. Users should apply these updates promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. Since this is an official fix, applying the vendor-provided updates fully mitigates the vulnerability.

Description

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * lodash: lodash: Arbitrary code execution via untrusted input in template imports (CVE-2026-4800) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

Community reviews

Loading reviews…