CVE-2018-1086

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-04-12 · updated 2026-06-17
Weakness: CWE-20

Description

pcs before versions 0.9.164 and 0.10 is vulnerable to a debug parameter removal bypass. REST interface of the pcsd service did not properly remove the pcs debug argument from the /run_pcs query, possibly disclosing sensitive information. A remote attacker with a valid token could use this flaw to elevate their privilege.

Affected products

ClusterLabs Pacemaker Command Line Interface: 0.9.164, 0.10
Debian Linux: 9.0
RedHat Enterprise Linux Server Eus: 7.5, 7.6

References

https://access.redhat.com/errata/RHSA-2018:1060
https://access.redhat.com/errata/RHSA-2018:1927
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1086
https://www.debian.org/security/2018/dsa-4169
https://access.redhat.com/errata/RHSA-2018:1060
https://access.redhat.com/errata/RHSA-2018:1927
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1086
https://www.debian.org/security/2018/dsa-4169

Get alerted when CVE-2018-1086 or the next vulnerability affects your stack