CVE-2010-2496
stonith-ng in pacemaker and cluster-glue passed passwords as commandline parameters, making it...
stonith-ng in pacemaker and cluster-glue passed passwords as commandline parameters, making it possible for local attackers to gain access to passwords of the HA stack and potentially influence its operations. This is fixed in cluster-glue 1.0.6 and newer, and pacemaker 1.1.3 and newer.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
stonith-ng in pacemaker and cluster-glue passed passwords as commandline parameters, making it possible for local attackers to gain access to passwords of the HA stack and potentially influence its operations. This is fixed in cluster-glue 1.0.6 and newer, and pacemaker 1.1.3 and newer.
- Record
CVE-2010-2496- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
stonith-ng in pacemaker and cluster-glue passed passwords as commandline parameters, making it possible for local attackers to gain access to passwords of the HA stack and potentially influence its operations. This is fixed in cluster-glue 1.0.6 and newer, and pacemaker 1.1.3 and newer.
- Record
CVE-2010-2496- Updated
- 2026-11-02
EUVDEUVD-2010-2500 No score
stonith-ng in pacemaker and cluster-glue passed passwords as commandline parameters, making it possible for local attackers to gain access to passwords of the HA stack and potentially influence its operations. This is fixed in cluster-glue 1.0.6 and newer, and pacemaker 1.1.3 and newer.
- Record
EUVD-2010-2500- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4643-vgh5-4r2c No score
stonith-ng in pacemaker and cluster-glue passed passwords as commandline parameters, making it...
stonith-ng in pacemaker and cluster-glue passed passwords as commandline parameters, making it possible for local attackers to gain access to passwords of the HA stack and potentially influence its operations. This is fixed in cluster-glue 1.0.6 and newer, and pacemaker 1.1.3 and newer.
- Record
GHSA-4643-vgh5-4r2c- Weakness
- CWE-287
- Updated
- 2026-11-02
OSV
stonith-ng in pacemaker and cluster-glue passed passwords as commandline parameters, making it possible for local attackers to gain access to passwords of the HA stack and potentially influence its operations. This is fixed in cluster-glue 1.0.6 and newer, and pacemaker 1.1.3 and newer.
- Record
CVE-2010-2496- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2010-2496
stonith-ng in pacemaker and cluster-glue passed passwords as commandline parameters, making it possible for local attackers to gain access to passwords of the HA stack and potentially influence its operations. This is fixed in cluster-glue 1.0.6 and newer, and pacemaker 1.1.3 and newer.
- Record
DEBIAN-CVE-2010-2496- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2010-2496
stonith-ng in pacemaker and cluster-glue passed passwords as commandline parameters, making it possible for local attackers to gain access to passwords of the HA stack and potentially influence its operations. This is fixed in cluster-glue 1.0.6 and newer, and pacemaker 1.1.3 and newer.
- Record
UBUNTU-CVE-2010-2496- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10507-1 No score
libpacemaker-devel-1.1.15+git20161104.b6f251a-1.1 on GA media
These are all security issues fixed in the libpacemaker-devel-1.1.15+git20161104.b6f251a-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10507-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cluster-glueDebian:12 |
before 1.0.6-1 | 1.0.6-1 |
cluster-glueDebian:13 |
before 1.0.6-1 | 1.0.6-1 |
cluster-glueDebian:14 |
before 1.0.6-1 | 1.0.6-1 |
pacemakerDebian:12 |
before 1.1.13-1 | 1.1.13-1 |
pacemakerDebian:13 |
before 1.1.13-1 | 1.1.13-1 |
pacemakerDebian:14 |
before 1.1.13-1 | 1.1.13-1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-2496 is a medium vulnerability (CVSS 5.5) in Clusterlabs Pacemaker, published October 18, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 14th percentile. Fixed in cluster-glue 1.0.6-1.
References
bugzilla.suse.com/show_bug.cgi?id=CVE-2010-2496
nvd.nist.gov/vuln/detail/CVE-2010-2496
github.com/advisories/GHSA-4643-vgh5-4r2c
security-tracker.debian.org/tracker/CVE-2010-2496
ubuntu.com/security/CVE-2010-2496
Show 7 moreShow less
cve.org/CVERecord?id=CVE-2010-2496
suse.com/security/cve/CVE-2010-2496