CVE-2018-1086

Name: CVE-2018-1086
Creator: NVD / NIST
Published: 2018-04-12T16:29:00.417+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 1.65%

Last modified Jun 17, 2026

CVE-2018-1086 is a vulnerability of currently unknown severity. pcs before versions 0.9.164 and 0.10 is vulnerable to a debug parameter removal bypass. REST interface of the pcsd service did not properly remove the pcs debug argument from the /run_pcs query, possibly disclosing sensitive information. EPSS estimates a 1.65% chance of exploitation in the next 30 days.

Description

pcs before versions 0.9.164 and 0.10 is vulnerable to a debug parameter removal bypass. REST interface of the pcsd service did not properly remove the pcs debug argument from the /run_pcs query, possibly disclosing sensitive information. A remote attacker with a valid token could use this flaw to elevate their privilege.

Metrics

EPSS Probability

1.65%

73.6th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Clusterlabs	Pacemaker Command Line Interface	0.9.164
Clusterlabs	Pacemaker Command Line Interface	0.10
Debian	Debian Linux	9.0
Redhat	Enterprise Linux Server Eus	7.5
Redhat	Enterprise Linux Server Eus	7.6

References

https://access.redhat.com/errata/RHSA-2018:1060Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1927Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1086Issue Tracking, Third Party Advisory
https://www.debian.org/security/2018/dsa-4169Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1060Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1927Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1086Issue Tracking, Third Party Advisory
https://www.debian.org/security/2018/dsa-4169Third Party Advisory

Timeline

Published: Apr 12, 2018
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2018-1086?

How severe is CVE-2018-1086?

Severity scoring for CVE-2018-1086 is pending analysis. The EPSS model estimates a 1.65% probability of exploitation in the next 30 days.

How do I fix CVE-2018-1086?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2018-1086?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST