Threat database

A vulnerability in the Pacemaker Configuration System (PCS) allows a local attacker with membership in the 'haclient' group to read arbitrary files shorter than 256 bytes using the 'pcs host auth --token' command. This can lead to disclosure of sensitive information such as API keys and configuration secrets. The flaw affects PCS versions from 0.10.8 onwards, including those shipped with RHEL 8.4+, 9.0+, and 10.0+. Exploitation requires local access and privileged group membership, limiting the attack scope. Mitigation involves restricting 'haclient' group membership to trusted users.