Is CVE-2010-2496 actively exploited?

No active exploitation of CVE-2010-2496 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2010-2496 be exploited remotely?

No. CVE-2010-2496 requires local access to exploit.

What is the CVSS score of CVE-2010-2496?

CVE-2010-2496 has a CVSS score of 5.5 (MEDIUM).

HOME VULNERABILITIESCVE-2010-2496

MEDIUM

CVE-2010-2496

CWE-287Published: October 18, 2021· Updated: Jun 16, 2026

5.5

CVSS v3.1

Official Description

stonith-ng in pacemaker and cluster-glue passed passwords as commandline parameters, making it possible for local attackers to gain access to passwords of the HA stack and potentially influence its operations. This is fixed in cluster-glue 1.0.6 and newer, and pacemaker 1.1.3 and newer.

NVD Source

Technical Analysis

CVE-2010-2496 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 5.5.

From a weakness classification perspective (CWE-287): Authentication bypass vulnerabilities allow attackers to access protected resources without valid credentials.