# CVE-2026-84828: Pcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --token

Status: published. Published: 2026-09-10. Updated: 2026-11-06.

A flaw was found in PCS (Pacemaker Configuration System). A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read with root privileges by the pcsd daemon and can be exfiltrated by the attacker through subsequent cluster node communication. This allows disclosure of sensitive data such as API keys, tokens, or configuration secrets that would otherwise be inaccessible to the attacker.

## Remediation

- workaround: Restrict membership in the 'haclient' group to only trusted users who require cluster management access. Audit current 'haclient' group membership and remove any unnecessary accounts. This reduces exposure but does not fully eliminate the risk for legitimate haclient members. (source: CNA: redhat)

## Affected products and versions

- Red Hat / Red Hat Enterprise Linux 10 (pcs): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8 (pcs): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9 (pcs): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4 (openshift/ose-rhel-coreos-9): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 5 (openshift/ose-rhel-coreos-9): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenStack Platform 16.2 (rhosp-rhel8/openstack-base): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenStack Platform 17.1 (rhosp-rhel9/openstack-frr): Version range not reported. Source: CNA: redhat

## Severity and prioritization

- CVSS 3.1: 6.5 (medium); CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N; source: CNA: redhat

- CISA KEV: No listing in collected sources

- EPSS: 0.14% as of 2026-11-05; percentile 3.59%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-732

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://access.redhat.com/security/cve/CVE-2026-84828 (CNA: redhat; vdb-entry, x_refsource_REDHAT)

- https://bugzilla.redhat.com/show_bug.cgi?id=2527320 (CNA: redhat; issue-tracking, x_refsource_REDHAT)

- https://github.com/ClusterLabs/pcs/commit/9178b78d11baa70e700a5c0d9fc1c17f27d452fa (CNA: redhat)

## Provenance

- CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2026-84828; retrieved 2026-11-06; source updated 2026-11-06

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-84828; retrieved 2026-11-06; source updated Not reported

Revision: e01378eae796c261e946d68cbf91e54bbf6a493c602fa13b5d46fd7964c8daed

Canonical: https://y2.dev/cve/CVE-2026-84828

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.