CVE-2026-16531: PCP pmproxy Path Traversal Vulnerability

CVE-2026-16531 Overview

CVE-2026-16531 is a path traversal vulnerability [CWE-22] in the Performance Co-Pilot (PCP) pmproxy logger servlet. An unauthenticated remote attacker can supply a crafted hostname that escapes the intended directory, allowing arbitrary file and directory creation on the target host. Successful exploitation can lead to denial of service through disk exhaustion or corruption of critical filesystem paths.

The issue is network-reachable, requires no privileges, and requires no user interaction. Because the vulnerability affects the logger component that accepts remote input, any exposed pmproxy instance is at risk.

Critical Impact
Unauthenticated remote attackers can create arbitrary files and directories on hosts running the PCP pmproxy logger servlet, enabling denial of service conditions.

Affected Products

Performance Co-Pilot (PCP) pmproxy component
Red Hat distributions shipping affected PCP packages
Linux systems exposing the pmproxy logger servlet to untrusted networks

Discovery Timeline

2026-07-30 - CVE-2026-16531 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-16531

Vulnerability Analysis

Performance Co-Pilot (PCP) is a system-level performance monitoring framework. The pmproxy daemon acts as a proxy between remote clients and local pmcd collectors, and it exposes a logger servlet that records client connection metadata including hostnames.

The logger servlet uses the client-supplied hostname to construct filesystem paths without properly sanitizing directory traversal sequences. An attacker can supply a hostname containing ../ sequences to escape the intended log directory. The servlet then creates files or directories at attacker-chosen locations relative to the pmproxy process working directory.

Because pmproxy typically runs as a dedicated service account with write access to system logging locations, the attacker can plant files across accessible portions of the filesystem. Repeated exploitation can exhaust inodes or disk space, producing a denial of service.

Root Cause

The root cause is missing input validation on the hostname string used in filesystem path construction. The logger servlet concatenates untrusted input into a target path without canonicalizing the result or rejecting traversal sequences, matching the CWE-22 pattern.

Attack Vector

Exploitation requires network reachability to the pmproxy service. The attacker connects to the logger endpoint and provides a crafted hostname value containing path traversal metacharacters. No authentication or user interaction is required. Technical specifics are documented in the Red Hat CVE-2026-16531 Advisory and Red Hat Bug Report #2506037.

Detection Methods for CVE-2026-16531

Indicators of Compromise

Unexpected files or directories appearing under paths writable by the pmproxy service account
pmproxy log entries containing hostname fields with ../ sequences or non-DNS characters
Sudden disk space or inode exhaustion on hosts running PCP
Connections to pmproxy (default TCP 44322) from untrusted source addresses

Detection Strategies

Inspect pmproxy access logs for hostname values that do not match valid DNS syntax
Monitor filesystem creation events under directories owned by the pcp user, correlating against network connections to pmproxy
Alert on process activity from pmproxy that writes outside its expected log directory

Monitoring Recommendations

Ingest PCP daemon logs into a centralized logging pipeline and apply rules for path traversal patterns in hostname fields
Baseline normal file creation behavior of the pmproxy process and alert on deviations
Track network connections to pmproxy service ports and flag connections originating outside management networks

How to Mitigate CVE-2026-16531

Immediate Actions Required

Restrict network access to pmproxy so only trusted monitoring hosts can reach the service
Audit exposed PCP deployments and identify any pmproxy instances reachable from untrusted networks
Review filesystem contents under paths writable by the pcp user for evidence of prior exploitation

Patch Information

Refer to the Red Hat CVE-2026-16531 Advisory for updated PCP package versions and distribution-specific errata. Apply vendor-provided patches through the standard package manager once available for your distribution.

Workarounds

Bind pmproxy to localhost or a management-only interface if remote proxy functionality is not required
Enforce firewall rules restricting inbound traffic to pmproxy ports from trusted subnets only
Disable the pmproxy service on hosts that do not require remote PCP proxying

bash

# Configuration example: restrict pmproxy to loopback
# Edit /etc/pcp/pmproxy/pmproxy.options and set:
-i 127.0.0.1

# Then restart the service
systemctl restart pmproxy

# Verify binding
ss -ltnp | grep pmproxy