Read the docs
TI-2015-01677 Aliases CVE-2015-1867GHSA-95mv-cmj7-gfh7

Pacemaker before 1.1.13 does not properly evaluate added nodes, which allows remote…

Priority LOW 38CWE-264Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-264.

Summary

Pacemaker before 1.1.13 does not properly evaluate added nodes, which allows remote read-only users to gain privileges via an acl command.

Why it matters now

EPSS 0.03 87th percentileScored 2026-11-07
Fix Fixed Red Hat: 2 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:o:redhat:enterprise_linux_high_availability:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_high_availability:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_resilient_storage:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_resilient_storage:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:a:clusterlabs:pacemaker:*:*:*:*:*:*:*:*up to 1.1.12VulnerableClusterLabs
  • cpe:2.3:o:redhat:enterprise_linux_high_availability:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_high_availability:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_resilient_storage:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_resilient_storage:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:a:clusterlabs:pacemaker:*:*:*:*:*:*:*:* Versions up to 1.1.12 Vulnerable ·ClusterLabs

Remediation

Red Hat 2 advisories

  • RHSA-2015:2383 Released 2015-11-19 · Red Hat rating Moderate
    pacemaker security, bug fix, and enhancement update
    • Red Hat Enterprise Linux Server High Availability (v. 7) pacemaker-1.1.13-10.el7, pacemaker-cli-1.1.13-10.el7, pacemaker-cluster-libs-1.1.13-10.el7 +6
    • Red Hat Enterprise Linux Server Resilient Storage (v. 7) pacemaker-1.1.13-10.el7, pacemaker-cli-1.1.13-10.el7, pacemaker-cluster-libs-1.1.13-10.el7 +6
  • RHSA-2015:1424 Released 2015-07-20 · Red Hat rating Moderate
    pacemaker security and bug fix update
    • Red Hat Enterprise Linux High Availability (v. 6) pacemaker-1.1.12-8.el6, pacemaker-cli-1.1.12-8.el6, pacemaker-cluster-libs-1.1.12-8.el6 +5
    • Red Hat Enterprise Linux Resilient Storage (v. 6) pacemaker-1.1.12-8.el6, pacemaker-cli-1.1.12-8.el6, pacemaker-cluster-libs-1.1.12-8.el6 +5

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux High Availability (v. 6)Fixed RHSA-2015:1424
Red Hat Enterprise Linux Resilient Storage (v. 6)Fixed RHSA-2015:1424
Red Hat Enterprise Linux Server High Availability (v. 7)Fixed RHSA-2015:2383
Red Hat Enterprise Linux Server Resilient Storage (v. 7)Fixed RHSA-2015:2383

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-1867
  2. 2026-10-03 Alias added: GHSA-95mv-cmj7-gfh7

References

Advisory 6

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences