The pcs packages, which provide command-line configuration for Pacemaker and Corosync, are affected by an open redirect vulnerability in the Sinatra framework via the X-Forwarded-Host header (CVE-2024-21510). This vulnerability could allow an attacker to redirect users to arbitrary URLs. Red Hat has issued a security advisory (RHSA-2024:10987) with patches available for affected versions of Red Hat Enterprise Linux 8 High Availability and Resilient Storage across multiple architectures. The vulnerability is rated moderate in severity by Red Hat Product Security.

The vulnerability allows an open redirect via the X-Forwarded-Host header, which could be leveraged to redirect users to malicious sites. While this is considered a moderate security impact, it does not indicate direct code execution or privilege escalation. No known exploits in the wild have been reported at this time.

A security update is available and should be applied to affected systems. Red Hat provides updated pcs packages in version 0.10.18-2.el8_10.3 for Red Hat Enterprise Linux 8 variants. Users should follow the official Red Hat guidance at https://access.redhat.com/articles/11258 to apply the update. No additional mitigations are specified by the vendor.