The pcs packages in Red Hat Enterprise Linux, which configure Pacemaker and Corosync, are affected by CVE-2026-4800, a vulnerability in the lodash library that permits arbitrary code execution through untrusted input in template imports. Red Hat has issued security advisories RHSA-2026:10710 and RHSA-2026:10713 providing updated pcs packages that remediate this issue. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code) and affects multiple Red Hat Enterprise Linux High Availability and Resilient Storage product variants for versions 9 and 10. The vendor advisory confirms the availability of patches and provides detailed update instructions.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on affected systems via untrusted input processed by lodash in pcs packages. This could compromise the integrity and security of systems running Red Hat Enterprise Linux High Availability and Resilient Storage variants. The vulnerability is rated as important by Red Hat, indicating a high security impact but not critical. No known exploits in the wild have been reported at this time.

Red Hat has released official patches for this vulnerability in updated pcs packages for Red Hat Enterprise Linux versions 9 and 10, including High Availability and Resilient Storage variants. Users should apply these updates promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. Since this is an official fix, applying the vendor-provided updates fully mitigates the vulnerability.