CVE-2026-16527: Pcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rules
An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.
Other sources
Summary: The pmproxy REST API exposes a /store endpoint writing to any PMDA metric via pmStore() without authentication. Two authentication flags (-S for credential requirements, -Q for client certificate) exist as case blocks in the source but are absent from the shortoptions string and longopts table, making both code paths permanently dead and impossible to activate. Combined with an unrestricted hostspec parameter, an unauthenticated HTTP attacker can force pmproxy to connect to pmcd via Unix socket, bypassing all pmcd [access] host rules that cover only IPv4 and IPv6 transports. Prerequisites: pmproxy running and reachable on default port 44322. pmcd running. linuxsockets PMDA loaded (required for the full RCE chain with Vulnerability 3).
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/pcpto a version that resolves this vulnerability.Fixed in 7.2.1-2 - Upgrade
Upgrade
debian/pcpto a version that resolves this vulnerability.Fixed in 7.2.2-1
Event History
Frequently Asked Questions
Which systems are exposed to remote exploitation?
Systems are exposed when pmproxy is running and reachable on its default port, 44322, while pmcd is also running. The described full remote-code-execution chain additionally requires the linux_sockets PMDA to be loaded.
Does enabling pmproxy authentication flags mitigate this issue?
No. The -S credential-requirement and -Q client-certificate flags have unreachable code paths because they are absent from the option parsing definitions, so they cannot be activated.
How are pmcd access rules bypassed?
A crafted /store request can supply an unrestricted hostspec that causes pmproxy to connect to pmcd through a Unix socket. This bypasses pmcd [access] rules that apply only to IPv4 and IPv6 transports.
What is the impact if an attacker reaches the endpoint?
An unauthenticated attacker can write to any PMDA metric through pmStore(). With the linux_sockets PMDA loaded, this can form a chain to arbitrary code execution and system takeover.