This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-16527 →

DEBIAN-CVE-2026-16527

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker...

Original description

The description as published by the source.

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 pcp

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 pcp

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

References

advisory security-tracker.debian.org