CVE-2022-2735: Clusterlabs Pcs

High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days.

A vulnerability was found in the PCS project. This issue occurs due to incorrect permissions on a Unix socket used for internal communication between PCS daemons. A privilege escalation could happen by obtaining an authentication token for a hacluster user. With the "hacluster" token, this flaw allows an attacker to have complete control over the cluster managed by PCS.

Affected products

• Clusterlabs Pcs: from 0.10.5, up to and including 0.11.3
• Debian Debian Linux: version 11.0 only

Published 2022-09-06. Last modified 2026-06-17.