PCP pmproxy CVE-2026-16531

Exploitation requires only that the pmproxy service is network-reachable and its logger servlet is active - no authentication, no user interaction, and no non-default configuration is required, consistent with the CVSS:3.1 PR:N/UI:N/AC:L vector. The limiting factor is network exposure: pmproxy must be reachable by the attacker, which is the default on any host running PCP where the port is not firewalled. Exploitation is constrained to file and directory creation only - no file read, no code execution - which limits the severity of any single exploit attempt. The practical DoS path requires repeated or high-volume requests to fill disk space or corrupt a critical directory structure. RHEL systems where pmproxy is not installed or not running are not affected.

The CVSS 3.1 base score of 5.3 (Medium) reflects AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - network-accessible, low complexity, no authentication, no confidentiality impact. The unauthenticated network vector and low attack complexity make this reachable by any attacker with network access to the pmproxy port, which is a meaningful exposure factor on externally facing or shared infrastructure. However, impact is constrained: exploitation yields only arbitrary file and directory creation, not file read or code execution. The official CVSS assigns A:N despite the description explicitly acknowledging denial-of-service potential via disk exhaustion or directory corruption - this appears to underweight the availability risk. No EPSS data was provided in the intelligence set, and the vulnerability is absent from the CISA KEV catalog. No public exploit code has been identified at time of analysis. Combined, this is a real but low-urgency issue: prioritize patching on hosts where pmproxy is internet-exposed or where disk exhaustion has operational impact (e.g., logging servers, monitoring nodes).

An unauthenticated attacker with network access to the pmproxy service submits an HTTP request to the logger servlet endpoint using a crafted hostname value containing path traversal sequences such as '../../etc/cron.d/malicious'. The servlet processes the hostname without sanitization and creates the specified path on the filesystem, potentially writing a directory or file to a sensitive location outside the logging root. Repeated exploitation with disk-filling filenames could exhaust available filesystem space, crashing dependent services and causing a denial of service condition. No public exploit code has been identified at time of analysis.