CVE-2015-1867

Pacemaker before 1.1.13 does not properly evaluate added nodes, which allows remote read-only...

7.5 HighFix available

Pacemaker before 1.1.13 does not properly evaluate added nodes, which allows remote read-only users to gain privileges via an acl command.

Exploit likelihood

3.00%Up 1.5 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Pacemaker before 1.1.13 does not properly evaluate added nodes, which allows remote read-only users to gain privileges via an acl command.

Record: CVE-2015-1867
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-264
Updated: 2026-11-02

CVE List No score

Pacemaker before 1.1.13 does not properly evaluate added nodes, which allows remote read-only users to gain privileges via an acl command.

Record: CVE-2015-1867
Updated: 2026-11-02

EUVDEUVD-2015-1973 No score

Pacemaker before 1.1.13 does not properly evaluate added nodes, which allows remote read-only users to gain privileges via an acl command.

Record: EUVD-2015-1973
Updated: 2026-11-03

GitHub AdvisoriesGHSA-95mv-cmj7-gfh7 No score

Pacemaker before 1.1.13 does not properly evaluate added nodes, which allows remote read-only...

Pacemaker before 1.1.13 does not properly evaluate added nodes, which allows remote read-only users to gain privileges via an acl command.

Record: GHSA-95mv-cmj7-gfh7
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10507-1 No score

libpacemaker-devel-1.1.15+git20161104.b6f251a-1.1 on GA media

These are all security issues fixed in the libpacemaker-devel-1.1.15+git20161104.b6f251a-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10507-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`pacemaker` Red Hat:enterprise_linux:6::server	before 0:1.1.12-8.el6	0:1.1.12-8.el6
`pacemaker-cli` Red Hat:enterprise_linux:6::server	before 0:1.1.12-8.el6	0:1.1.12-8.el6
`pacemaker-cluster-libs` Red Hat:enterprise_linux:6::server	before 0:1.1.12-8.el6	0:1.1.12-8.el6
`pacemaker-cts` Red Hat:enterprise_linux:6::server	before 0:1.1.12-8.el6	0:1.1.12-8.el6
`pacemaker-debuginfo` Red Hat:enterprise_linux:6::server	before 0:1.1.12-8.el6	0:1.1.12-8.el6
`pacemaker-doc` Red Hat:enterprise_linux:6::server	before 0:1.1.12-8.el6	0:1.1.12-8.el6
`pacemaker-libs` Red Hat:enterprise_linux:6::server	before 0:1.1.12-8.el6	0:1.1.12-8.el6
`pacemaker-libs-devel` Red Hat:enterprise_linux:6::server	before 0:1.1.12-8.el6	0:1.1.12-8.el6
`pacemaker-remote` Red Hat:enterprise_linux:6::server	before 0:1.1.12-8.el6	0:1.1.12-8.el6
`pacemaker` Red Hat:enterprise_linux:7::server	before 0:1.1.13-10.el7	0:1.1.13-10.el7

Show 9 moreShow less

Affected packages
Package	Affected	Fixed
`pacemaker-cli` Red Hat:enterprise_linux:7::server	before 0:1.1.13-10.el7	0:1.1.13-10.el7
`pacemaker-cluster-libs` Red Hat:enterprise_linux:7::server	before 0:1.1.13-10.el7	0:1.1.13-10.el7
`pacemaker-cts` Red Hat:enterprise_linux:7::server	before 0:1.1.13-10.el7	0:1.1.13-10.el7
`pacemaker-debuginfo` Red Hat:enterprise_linux:7::server	before 0:1.1.13-10.el7	0:1.1.13-10.el7
`pacemaker-doc` Red Hat:enterprise_linux:7::server	before 0:1.1.13-10.el7	0:1.1.13-10.el7
`pacemaker-libs` Red Hat:enterprise_linux:7::server	before 0:1.1.13-10.el7	0:1.1.13-10.el7
`pacemaker-libs-devel` Red Hat:enterprise_linux:7::server	before 0:1.1.13-10.el7	0:1.1.13-10.el7
`pacemaker-nagios-plugins-metadata` Red Hat:enterprise_linux:7::server	before 0:1.1.13-10.el7	0:1.1.13-10.el7
`pacemaker-remote` Red Hat:enterprise_linux:7::server	before 0:1.1.13-10.el7	0:1.1.13-10.el7

History

History
Recorded	Changed	Sources
Nov 6, 2026	facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-1867 is a high vulnerability (CVSS 7.5) in Clusterlabs Pacemaker, published August 12, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.00%, the 87th percentile. Fixed in pacemaker 0:1.1.12-8.el6.

References

Show 36 moreShow less