Vulnerability · Published Jul 30, 2026 · Assigned by redhat

CVE-2026-16527Pcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rules

High 7.3

In plain English

A high-severity missing authentication in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.6%top 51.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10pcp7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:9pcp6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-conf7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-conf5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-conf6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-devel7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-devel5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-devel6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-doc7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-doc5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-doc6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-export-pcp2elasticsearch7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-export-pcp2elasticsearch5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-export-pcp2elasticsearch6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-export-pcp2graphite7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-export-pcp2graphite5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-export-pcp2graphite6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-export-pcp2influxdb7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-export-pcp2influxdb5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-export-pcp2influxdb6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-export-pcp2json7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-export-pcp2json5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-export-pcp2json6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-export-pcp2openmetrics7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:9pcp-export-pcp2openmetrics6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-export-pcp2opentelemetry7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:10pcp-export-pcp2spark7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-export-pcp2spark5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-export-pcp2spark6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-export-pcp2xml7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-export-pcp2xml5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-export-pcp2xml6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-export-pcp2zabbix7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-export-pcp2zabbix5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-export-pcp2zabbix6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-export-zabbix-agent7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-export-zabbix-agent5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-export-zabbix-agent6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-geolocate7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:9pcp-geolocate6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-gui7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-gui5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-gui6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-import-benchmarks7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:10pcp-import-collectl2pcp7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-import-collectl2pcp5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-import-collectl2pcp6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-import-ganglia2pcp7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-import-ganglia2pcp5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-import-ganglia2pcp6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-import-iostat2pcp7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-import-iostat2pcp5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-import-iostat2pcp6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-import-mrtg2pcp7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:9pcp-import-mrtg2pcp6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-import-pmseries7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:10pcp-import-sar2pcp7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-import-sar2pcp5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-import-sar2pcp6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-libs7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-libs5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-libs6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-libs-devel7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:9pcp-libs-devel6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-activemq7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-pmda-activemq5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-pmda-activemq6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-amdgpu7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:9pcp-pmda-amdgpu6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-apache7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-pmda-apache5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-pmda-apache6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-bash7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-pmda-bash5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-pmda-bash6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-bcc7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-pmda-bcc5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-pmda-bcc6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-bind27.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:9pcp-pmda-bind26.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-bonding7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-pmda-bonding5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-pmda-bonding6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-bpf7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:9pcp-pmda-bpf6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-bpftrace7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-pmda-bpftrace5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-pmda-bpftrace6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-cifs7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:9pcp-pmda-cifs6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-cisco7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-pmda-cisco5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-pmda-cisco6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-dbping7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-pmda-dbping5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-pmda-dbping6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-denki7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-pmda-denki5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-pmda-denki6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-dm7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-pmda-dm5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-pmda-dm6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-docker7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-pmda-docker5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-pmda-docker6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-ds3897.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-pmda-ds3895.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-pmda-ds3896.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-ds389log7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-pmda-ds389log5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-pmda-ds389log6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-elasticsearch7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-pmda-elasticsearch5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-pmda-elasticsearch6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-farm7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:9pcp-pmda-farm6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:8pcp-pmda-gfs25.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-pmda-gfs26.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-gluster7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-pmda-gluster5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-pmda-gluster6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-gpfs7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-pmda-gpfs5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-pmda-gpfs6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-gpsd7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:9pcp-pmda-gpsd6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-hacluster7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-pmda-hacluster5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-pmda-hacluster6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-haproxy7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-pmda-haproxy5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-pmda-haproxy6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-hdb7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:10pcp-pmda-infiniband7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-pmda-infiniband5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-pmda-infiniband6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:8pcp-pmda-json5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-pmda-json6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-libvirt7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-pmda-libvirt5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-pmda-libvirt6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-lio7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-pmda-lio5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-pmda-lio6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-lmsensors7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-pmda-lmsensors5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-pmda-lmsensors6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-logger7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:9pcp-pmda-logger6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-lustre7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-pmda-lustre5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-pmda-lustre6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-lustrecomm7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-pmda-lustrecomm5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-pmda-lustrecomm6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-mailq7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-pmda-mailq5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-pmda-mailq6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-memcache7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-pmda-memcache5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-pmda-memcache6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-mic7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-pmda-mic5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-pmda-mic6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-mongodb7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:9pcp-pmda-mongodb6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-mounts7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:9pcp-pmda-mounts6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-mssql7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-pmda-mssql5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-pmda-mssql6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-mysql7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-pmda-mysql5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-pmda-mysql6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-named7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-pmda-named5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-pmda-named6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-netcheck7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-pmda-netcheck5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-pmda-netcheck6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-netfilter7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-pmda-netfilter5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-pmda-netfilter6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-news7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-pmda-news5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-pmda-news6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-nfsclient7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-pmda-nfsclient5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-pmda-nfsclient6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-nginx7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:9pcp-pmda-nginx6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-nvidia-gpu7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:9pcp-pmda-nvidia-gpu6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-openmetrics7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-pmda-openmetrics5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-pmda-openmetrics6.3.7-8.el9_8.4ALSA-2026:55740
AlmaLinux:10pcp-pmda-opentelemetry7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:10pcp-pmda-openvswitch7.0.3-5.el10_2ALSA-2026:55617
AlmaLinux:8pcp-pmda-openvswitch5.3.7-22.el8_10.5ALSA-2026:55560
AlmaLinux:9pcp-pmda-openvswitch6.3.7-8.el9_8.4ALSA-2026:55740

Affected products (as reported)

Weakness: CWE-306, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References