CVE-2026-16527: 
Linux Debian Analyse et atténuation des vulnérabilités

CVE-2026-16527 is an access control bypass vulnerability in the Performance Co-Pilot (PCP) pmproxy component that allows unauthenticated remote attackers to overwrite any PMDA metric via the /store endpoint, potentially leading to arbitrary code execution and full system takeover. It affects the pcp package across Red Hat Enterprise Linux 7, 8, 9, and 10, as well as Red Hat OpenShift Container Platform 4 (via rhcos); RHEL 6 status is listed as unknown. The vulnerability was reported internally on July 22, 2026, and publicly disclosed on July 30, 2026. It carries a CVSS v3.1 base score of 7.3 (High), assigned by Red Hat (Red Hat CVE, Red Hat Bugzilla).

The root cause is a missing authentication enforcement in the pmproxy REST API's /store endpoint, which calls pmStore() to write to any PMDA metric without requiring credentials. Two authentication flags (-S for credential requirements and -Q for client certificate) exist as case blocks in the source code but are absent from the short_options string and longopts table, rendering both code paths permanently dead and impossible to activate — a classic case of incomplete or broken access control (no CWE formally assigned yet). Additionally, an unrestricted hostspec parameter allows an attacker to force pmproxy to connect to pmcd via Unix socket, bypassing all pmcd [access] host rules that only cover IPv4 and IPv6 transports. The full remote code execution chain requires pmproxy to be running and reachable on its default port (44322), pmcd to be running, and the linux_sockets PMDA to be loaded (Red Hat Bugzilla).

Successful exploitation allows an unauthenticated network attacker to overwrite arbitrary PMDA metrics, which — when chained with the linux_sockets PMDA — can lead to arbitrary code execution and complete system takeover. The vulnerability affects confidentiality, integrity, and availability, with all three rated as Low impact individually under CVSS but collectively enabling a critical outcome: full host compromise. Systems running PCP in monitoring-heavy environments (e.g., RHEL servers, OpenShift nodes) are at risk, and a compromised monitoring host could serve as a pivot point for lateral movement within the infrastructure (Red Hat CVE, Red Hat Bugzilla).

1. Reconnaissance: Scan for hosts with TCP port 44322 open (default pmproxy port) using tools like Nmap or Shodan to identify exposed PCP instances on RHEL 7/8/9/10 or OpenShift nodes.
2. Verify pmproxy accessibility: Send a basic HTTP GET request to http://<target>:44322/pmapi/context to confirm pmproxy is running and responsive without authentication.
3. Identify target PMDA metric: Query available metrics via http://<target>:44322/pmapi/metric?names=<metric> to identify a writable PMDA metric, particularly within the linux_sockets PMDA for the RCE chain.
4. Craft malicious /store request: Send an unauthenticated HTTP POST or GET request to http://<target>:44322/store with a crafted hostspec parameter pointing to the local Unix socket (e.g., unix:/var/run/pcp/pmcd.socket) and a payload overwriting a target PMDA metric value.
5. Bypass pmcd access rules: By specifying the Unix socket transport via hostspec, the connection bypasses pmcd's [access] rules (which only apply to IPv4/IPv6 transports), allowing the metric write to succeed.
6. Achieve code execution: Leverage the overwritten linux_sockets PMDA metric to trigger arbitrary command execution on the host, establishing a reverse shell or deploying a persistent backdoor (Red Hat Bugzilla).

• Network: Unexpected inbound HTTP connections to TCP port 44322 (pmproxy default) from external or untrusted IP addresses; HTTP requests to /store endpoint with unusual hostspec parameters referencing Unix sockets (e.g., unix:/var/run/pcp/pmcd.socket).
• Logs: pmproxy access logs showing unauthenticated POST/GET requests to /store; pmcd logs showing connections originating from Unix socket transport from unexpected sources; anomalous pmStore() calls for metrics not normally written by monitoring agents.
• Process: Unexpected child processes spawned by pmproxy or pmcd (e.g., /bin/bash, curl, wget, python, nc); new cron jobs or systemd units created under the PCP service account.
• File System: New or modified files in PCP installation directories (e.g., /var/lib/pcp/, /etc/pcp/); unexpected scripts or binaries dropped in world-writable directories.

Red Hat has acknowledged the vulnerability and a patch is noted as in progress (bug status: NEW as of disclosure). Until a fixed package version is released, administrators should restrict network access to pmproxy port 44322 using firewall rules (e.g., firewalld or iptables) to allow only trusted monitoring hosts. If pmproxy is not required, disabling or stopping the service (systemctl stop pmproxy && systemctl disable pmproxy) eliminates the attack surface entirely. Additionally, unloading the linux_sockets PMDA breaks the full RCE chain described in the bug report. Monitor the Red Hat CVE page and Bugzilla entry for patch availability and apply updates as soon as they are released (Red Hat CVE, Red Hat Bugzilla).