It was reported that pcs package is vulnerable to command injection with root privileges. A user supplied string is used to in running a system command. If the user uses escape characters they can run a command as the root user on the system.

To do this the user must already have access to login to pcsd (Be a member of the hacluster group).

It was reported that it's possible to get access as a different user when using pcsd (the pcs web UI) due to using a variable which is global to the server instead of the connection to validate usernames.

Scenario is following: User A sends a command to pcsd, after the connection is made and authentication happens, (but before any security checks are done), User B connects and authenticates. User A could potentially get access based on User B's permissions.

To take advantage of this the user must have access to login to pcsd.