Skip to main content

PCP pmproxy CVE-2026-16531

| EUVDEUVD-2026-50980 MEDIUM
Path Traversal (CWE-22)
2026-07-30 redhat GHSA-2g52-w93h-w9v5
Denial Of Service Path Traversal Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Openshift Container Platform 4 Red Hat
Medium
Disputed · 5.3 Vendor: redhat
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (redhat) PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
vuln.today AI
6.5 MEDIUM

Network-reachable with no auth; retaining I:L and upgrading A:N to A:L because the description explicitly identifies denial of service via filesystem exhaustion as a realized impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
SUSE
CRITICAL
qualitative
Red Hat
5.3 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 08:59 vuln.today
CVE Published
Jul 30, 2026 - 05:41 nvd
MEDIUM 5.3

DescriptionCVE.org

An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service.

AnalysisAI

Path traversal in the Performance Co-Pilot (PCP) pmproxy logger servlet on Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 permits unauthenticated remote attackers to create arbitrary files and directories on the host filesystem by supplying a crafted hostname value in requests to the service. The primitive is write-only - no file contents can be read - but an attacker can abuse it to corrupt directory structures or exhaust disk space, leading to denial of service. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

Performance Co-Pilot (PCP) is a system performance monitoring and analysis framework distributed with Red Hat Enterprise Linux across all major versions (6, 7, 8, 9, 10) and packaged in OpenShift Container Platform 4. The pmproxy daemon acts as a protocol proxy and REST gateway for PCP metrics. Its logger servlet processes client-supplied hostname values and uses them in filesystem operations without adequate sanitization. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) identifies the root cause: user-controlled input containing path traversal sequences (e.g., '../') is not neutralized before being used to construct filesystem paths, allowing the logger to create files or directories outside the intended logging directory. CPE strings confirm the vulnerability spans cpe:2.3:a:red_hat:red_hat_enterprise_linux_6 through cpe:2.3:a:red_hat:red_hat_enterprise_linux_10 and cpe:2.3:a:red_hat:red_hat_openshift_container_platform_4.

RemediationAI

Consult the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-16531 for updated PCP packages across affected RHEL versions; no specific patched package version number was confirmed from the available intelligence, so use the errata as the authoritative source. For RHEL systems subscribed to Red Hat Satellite or CDN, run 'yum update pcp' or 'dnf update pcp' and restart the pmproxy service. On OpenShift Container Platform 4, follow the advisory guidance for updated operator or image versions. As a compensating control if immediate patching is not possible, restrict network access to the pmproxy port (default TCP 44322) using firewalld or network ACLs to trusted monitoring hosts only - note this will limit PCP telemetry collection from untrusted segments. Disabling the pmproxy service entirely ('systemctl disable --now pmproxy') is a higher-impact but effective workaround on hosts where PCP proxying is not operationally required.

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
CVE-2026-28369 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel

CVE-2026-28368 CRITICAL
9.1 Mar 27

HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
CVE-2026-33845 CRITICAL
9.1 Apr 30

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
CVE-2026-28367 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
CVE-2026-16526 HIGH
8.8 Jul 30

Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Affected

Share

CVE-2026-16531 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy