CVE-2026-16527: PCP pmproxy Auth Bypass Vulnerability

CVE-2026-16527 Overview

CVE-2026-16527 is an access control bypass vulnerability in the Performance Co-Pilot (PCP) pmproxy daemon. An unauthenticated remote attacker can send crafted requests to the /store endpoint to overwrite Performance Metrics Domain Agent (PMDA) metric values. Overwriting PMDA metrics enables arbitrary code execution and full system takeover on affected hosts.

Critical Impact
Unauthenticated network attackers can overwrite arbitrary PMDA metrics through pmproxy, leading to code execution and complete host compromise.

Affected Products

Performance Co-Pilot (PCP) pmproxy component
Red Hat Enterprise Linux distributions shipping PCP (see Red Hat CVE-2026-16527 Advisory)
Systems exposing pmproxy to untrusted networks

Discovery Timeline

2026-07-30 - CVE-2026-16527 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-16527

Vulnerability Analysis

The flaw resides in the pmproxy HTTP interface, which brokers requests to PCP daemons and PMDAs. The /store endpoint fails to enforce access controls on incoming requests. An unauthenticated remote client can therefore issue write operations that modify metric values maintained by any registered PMDA.

PMDAs are trusted producers of performance data. Some PMDAs interpret metric writes as configuration or control operations. By overwriting a metric that influences agent behavior, an attacker can trigger execution paths that run under the privileges of the target PMDA process, resulting in arbitrary code execution.

Root Cause

The root cause is missing authentication and authorization checks on the pmproxy/store request handler. Requests reaching this endpoint are forwarded to the corresponding PMDA without verifying the caller's identity or permissions. This constitutes a broken access control condition on a network-facing service.

Attack Vector

Exploitation requires only network reachability to the pmproxy listener. No credentials, user interaction, or prior foothold is required. An attacker crafts an HTTP request targeting /store with a metric identifier and payload of choice, and pmproxy relays it to the target PMDA. Refer to the Red Hat Bug Report #2506031 for protocol-level details.

Detection Methods for CVE-2026-16527

Indicators of Compromise

HTTP requests to the pmproxy/store endpoint originating from untrusted or external source addresses.
Unexpected PMDA metric value changes in pmlogger archives that do not correlate with legitimate administrative activity.
New or anomalous child processes spawned by pmproxy or PMDA processes running as pcp or root.
Outbound network connections from pmproxy or PMDA processes to attacker-controlled infrastructure.

Detection Strategies

Monitor pmproxy access logs for POST or PUT requests to /store and alert on requests from non-management network segments.
Baseline expected PMDA metric write patterns and flag deviations, particularly writes to control metrics.
Correlate process execution telemetry on PCP hosts with pmproxy request logs to identify request-triggered command execution.

Monitoring Recommendations

Enable verbose logging in pmproxy and forward logs to a centralized SIEM for retention and correlation.
Alert on pmproxy listening on interfaces other than localhost where not operationally required.
Track parent-child process relationships for PCP daemons to detect unexpected execution chains.

How to Mitigate CVE-2026-16527

Immediate Actions Required

Restrict network access to pmproxy (default TCP port 44322) using host firewalls and network ACLs so only trusted monitoring hosts can connect.
Bind pmproxy to loopback or a dedicated management interface where remote collection is not required.
Audit exposed PCP hosts and identify any pmproxy instances reachable from untrusted networks.

Patch Information

Apply vendor updates as they become available. Consult the Red Hat CVE-2026-16527 Advisory for the current list of fixed package versions and errata identifiers. Update PCP packages across all affected hosts and restart the pmproxy service to load the patched binaries.

Workarounds

Stop and disable pmproxy on hosts that do not require remote metric proxying: systemctl disable --now pmproxy.
Enforce firewall rules that limit inbound access to pmproxy to a defined allowlist of monitoring collectors.
Place pmproxy behind an authenticating reverse proxy or VPN concentrator until vendor patches are deployed.

bash

# Configuration example
# Restrict pmproxy to loopback only
sudo sed -i 's/^PMPROXY_LOCAL=.*/PMPROXY_LOCAL=1/' /etc/sysconfig/pmproxy
sudo systemctl restart pmproxy

# Firewall: allow pmproxy only from a trusted monitoring host
sudo firewall-cmd --permanent --add-rich-rule=\
  'rule family="ipv4" source address="10.0.0.10/32" port port="44322" protocol="tcp" accept'
sudo firewall-cmd --permanent --add-rich-rule=\
  'rule family="ipv4" port port="44322" protocol="tcp" drop'
sudo firewall-cmd --reload