Description
Cross-site request forgery (CSRF) vulnerability in pcsd web UI in pcs before 0.9.149.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pcs | 0.9.149-1 | — |
| Debian 13 | pcs | 0.9.149-1 | — |
| Debian 12 | pcs | 0.9.149-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | pcs | 0.9.152-10.el7 | RHSA-2016:2596 |
Advisories 1
- RHSA-2016:2596 Red Hat Security Advisory: pcs security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · May 13, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1299614
- https://github.com/ClusterLabs/pcs/commit/b9e7f061788c3b86a0c67d2d4158f067ec5eb625
- FEDORA-2016-cdd4228cc7 vendor-advisory
- 97984 vdb-entry
- RHSA-2016:2596 vendor-advisory
- FEDORA-2016-3b20c4ec9d vendor-advisory