CVE-2026-16531: 
Linux Debian Analyse et atténuation des vulnérabilités

CVE-2026-16531 is a path traversal vulnerability (CWE-22) in the Performance Co-Pilot (PCP) pmproxy logger servlet that allows unauthenticated remote attackers to create arbitrary files and directories on the target system. The vulnerability was reported on July 22, 2026, and publicly disclosed on July 30, 2026. Affected products include the pcp package on Red Hat Enterprise Linux 8, 9, and 10, as well as Red Hat OpenShift Container Platform 4 (via rhcos); RHEL 6 and 7 status is listed as unknown. It carries a CVSS v3.1 base score of 5.3 (Medium), assigned by Red Hat (Red Hat CVE, Red Hat Bugzilla, GitHub Advisory).

The root cause is improper input sanitization (CWE-22) in the pmproxy logger servlet, which accepts a binary __pmLogLabel PDU via an HTTP POST request to /logger/label. The hostname field within this PDU is used unsanitized to construct an archive file path, allowing an attacker to supply a crafted hostname such as ../../../target/dir to traverse outside the intended directory and create files or directory trees at arbitrary paths accessible to the pcp process user. The logger servlet is registered unconditionally in http.c:1326 and is always active regardless of pmproxy configuration, requiring only that pmproxy be reachable on TCP port 44322 with no authentication (Red Hat Bugzilla).

Successful exploitation allows an unauthenticated remote attacker to create arbitrary files and directory structures at any path writable by the pcp process user, which can lead to denial of service — for example, by filling a filesystem or overwriting critical files. There is no confidentiality impact (no data is read or exfiltrated), and the integrity impact is limited to low-level file creation rather than modification of existing content. The vulnerability does not directly enable remote code execution, but uncontrolled file creation could be chained with other weaknesses to escalate impact (Red Hat CVE, GitHub Advisory).

1. Reconnaissance: Identify hosts running PCP pmproxy with TCP port 44322 open using network scanning tools such as Nmap (nmap -p 44322 <target>) or internet-wide scanners like Shodan.
2. Craft malicious PDU: Construct a binary __pmLogLabel PDU where the hostname field is set to a path traversal string, e.g., ../../../tmp/attacker_dir or a path targeting a sensitive directory writable by the pcp user.
3. Send HTTP POST request: Submit the crafted PDU to the logger servlet endpoint: POST http://<target>:44322/logger/label with the binary payload as the request body. No authentication headers are required.
4. Verify file/directory creation: Confirm that the target directory or file has been created at the traversed path on the server, indicating successful exploitation.
5. Achieve denial of service (optional): Repeat the request with varying paths or large numbers of files to exhaust filesystem space or inodes, causing a denial of service condition (Red Hat Bugzilla).

• Network: Unexpected HTTP POST requests to http://<host>:44322/logger/label from external or untrusted IP addresses; binary payloads in POST bodies to this endpoint.
• File System: Newly created files or directories in unexpected locations (e.g., /tmp, /var, system directories) owned by the pcp user or with timestamps correlating to suspicious network activity; directory trees with path traversal-style naming artifacts.
• Logs: pmproxy access or error logs showing POST requests to /logger/label from unusual source IPs; log entries referencing file creation outside the expected PCP archive directory.
• Process: Unusual disk usage growth attributed to the pcp process user; filesystem alerts triggered by rapid inode or space consumption (Red Hat Bugzilla).

Red Hat has acknowledged the vulnerability and a patch is in progress; specific fixed package versions have not yet been published as of the disclosure date. As an immediate workaround, restrict network access to pmproxy on TCP port 44322 using firewall rules to allow only trusted hosts. If pmproxy is not required, consider disabling the service entirely until a patch is available (Red Hat CVE, Red Hat Bugzilla).