PCP pmproxy Unauthenticated Access Control Bypass

CVE-2026-16527 represents a critical vulnerability in Performance Co-Pilot (PCP) pmproxy where unauthenticated attackers can bypass access controls through crafted requests to the /store endpoint. By exploiting insufficient authorization checks, attackers can overwrite arbitrary PMDA (Performance Metric Domain Agent) metrics, escalating privileges and achieving remote code execution. This vulnerability affects organizations relying on PCP for system performance monitoring and management, particularly in enterprise environments where pmproxy serves as a central metrics collection point. The ability to modify metrics without authentication creates a direct path to system compromise and persistence.

While this CVE currently lacks mapped MITRE ATT&CK techniques, Casky's 754 security skills enable detection of the attack patterns underlying this vulnerability. Practitioners using Casky would identify anomalous patterns consistent with CWE-284 (Improper Access Control) exploitation, including: unauthenticated HTTP requests to admin endpoints, unusual /store endpoint modifications, metric value changes without corresponding legitimate collector activity, and post-exploitation indicators like unexpected process execution from pmproxy contexts. Claude's extended reasoning capabilities help correlate these signals across system logs, network traffic, and application behavior to surface the access control failure and subsequent code execution attempts that characterize this attack pattern, allowing security teams to detect and respond before system takeover occurs.