6.5 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Local (L)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Scope (S): Changed (C)
- Confidentiality (C): High (H)
- Integrity (I): None (N)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Local (L)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Changed (C)
- Modified Integrity (MI): None (N)
- Modified Availability (MA): None (N)
Activity log
- Created suggestion
Pcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --token
A flaw was found in PCS (Pacemaker Configuration System). A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read with root privileges by the pcsd daemon and can be exfiltrated by the attacker through subsequent cluster node communication. This allows disclosure of sensitive data such as API keys, tokens, or configuration secrets that would otherwise be inaccessible to the attacker.
References
Affected products
Matching in nixpkgs
pkgs.vpcs
Simple virtual PC simulator
pkgs.pcsx2
Playstation 2 emulator
pkgs.rpcs3
PS3 emulator/debugger
-
nixos-unstable -
- nixos-unstable-small 0.0.42-unstable-2026-08-15
-
nixos-26.05 -
- nixos-26.05-small 0.0.40-unstable-2026-04-25
pkgs.pcstat
Page Cache stat: get page cache stats for files on Linux
pkgs.pcsclite
Middleware to access a smart card using SCard API (PC/SC)
pkgs.appcsxcad
Minimal Application using the QCSXCAD library
pkgs.pcsc-tools
Tools used to test a PC/SC driver, card or reader
pkgs.baidupcs-go
Baidu Netdisk commandline client, mimicking Linux shell file handling commands
pkgs.pcsc-safenet
Safenet Authentication Client
pkgs.rpcsvc-proto
This package contains rpcsvc proto.x files from glibc, which are missing in libtirpc
pkgs.libretro.pcsx2
Port of PCSX2 to libretro
-
nixos-unstable -
- nixos-unstable-small 0-unstable-2026-09-17
-
nixos-26.05 -
- nixos-26.05-small 0-unstable-2026-05-13
pkgs.pcsc-cyberjack
REINER SCT cyberJack USB chipcard reader user space driver
pkgs.pcsc-scm-scl011
SCM Microsystems SCL011 chipcard reader user space driver
pkgs.pcscliteWithPolkit
Middleware to access a smart card using SCard API (PC/SC)
pkgs.pkgsRocm.appcsxcad
Minimal Application using the QCSXCAD library
pkgs.libretro.pcsx-rearmed
Port of PCSX ReARMed to libretro
-
nixos-unstable -
- nixos-unstable-small 0-unstable-2026-09-05
-
nixos-26.05 -
- nixos-26.05-small 0-unstable-2026-05-15
pkgs.libretro.pcsx_rearmed
Port of PCSX ReARMed to libretro
-
nixos-unstable -
- nixos-unstable-small 0-unstable-2026-09-05
-
nixos-26.05 -
- nixos-26.05-small 0-unstable-2026-05-15
pkgs.vsmartcard-pcsc-relay
Relays a smart card using an contact-less interface
pkgs.haskellPackages.gpcsets
Generalized Pitch Class Sets for Haskell
pkgs.perlPackages.ChipcardPCSC
Communicate with a smart card using PC/SC
pkgs.perl5Packages.ChipcardPCSC
Communicate with a smart card using PC/SC
pkgs.python313Packages.huaweicloudsdkcpcs
Module of Huawei Cloud Python SDK (cpcs)
-
nixos-unstable -
- nixos-unstable-small 3.1.213
pkgs.python314Packages.huaweicloudsdkcpcs
Module of Huawei Cloud Python SDK (cpcs)
-
nixos-unstable -
- nixos-unstable-small 3.1.213
Package maintainers
-
@matthuszagh Matt Huszagh <huszaghmatt@gmail.com>
-
@xddxdd Yuhui Xu <b980120@hotmail.com>
-
@aanderse Aaron Andersen <aaron@fosslib.net>
-
@thiagokokada Thiago K. Okada <thiagokokada@gmail.com>
-
@igorcafe Igor Melo <igoracmelo@protonmail.com>
-
@flokli Florian Klink <flokli@flokli.de>
-
@aszlig aszlig <aszlig@nix.build>
-
@wldhx wldhx <wldhx+nixpkgs@wldhx.me>
-
@sephalon Stefan Wiehler <me@sephalon.net>
-
@peterhoeg Peter Hoeg <peter@hoeg.com>
-
@anthonyroussel Anthony Roussel <anthony@roussel.dev>
-
@AmineChikhaoui Amine Chikhaoui <amine.chikhaoui91@gmail.com>
-
@0david0mp David mp <davidmrpr@proton.me>
-
@matteo-pacini Matteo Pacini <m@matteopacini.me>
-
@GovanifY Gauvain 'GovanifY' Roussel-Tarbouriech <gauvain@govanify.com>
-
@fabaff Fabian Affolter <mail@fabian-affolter.ch>
-
@ilian ilian <nixos@ilian.dev>
-
@Ma27 Maximilian Bosch <maximilian@mbosch.me>
-
@StarGate01 Christoph Honal <christoph.honal@web.de>