Proxmox Datacenter Manager - Security Advisories

Status
Not open for further replies.

Subject: PSA-2026-00004-1: Authenticated Remote Code Execution via shell injection​


Advisory date: 2026-01-13

Packages: proxmox-datacenter-manager

Details: Missing separation between options and package name arguments in an apt-get invocation exposed over the API allowed an authenticated attacker with Sys.Modify privileges to inject arbitrary options into the resulting apt-get command line. Such an attacker could inject certain dpkg options that trigger arbitrary code execution as root user.

Only authenticated admin users with relatively powerful Sys.Modify privileges can access the vulnerable API endpoint.

Kevin Joensen <kevin@baldur.dk> of Baldur Security first reported this issue affecting the Proxmox Mail Gateway (PSA-2026-00001-1), our security team expanded the scope to the other projects.

Fixed: proxmox-datacenter-manager >= 1.0.2

References: Advisories PSA-2026-00001-1, PSA-2026-00002-1, and PSA-2026-00003-1 all address similar issues in other Proxmox projects.
 

Subject: PSA-2026-00010-1: "Crackarmor" apparmor vulnerabilities​


Advisory date: 2026-03-13

Packages: proxmox-kernel-*

Details:

Qualys discovered several vulnerabilities in the AppArmor LSM (Linux Security Module) code of the Linux kernel, which are being referred to as "Crackarmor".

All of the vulnerabilities require unprivileged local user access. The impact of these vulnerabilities ranges from denial of service, kernel memory information leak, removing security controls, local privilege escalation to root user to potential container escapes.

Refer to the upstream advisories linked below for more details.

Fixed:
- proxmox-kernel-6.8.12-20-pve(-signed) (Bookworm based releases)
- proxmox-kernel-6.14.11-6-bpo12-pve(-signed) (Bookworm based releases)
- proxmox-kernel-6.14.11-6-pve(-signed) (Trixie based releases)
- proxmox-kernel-6.17.13-2-pve(-signed) (Trixie based releases)

References:
- https://cdn2.qualys.com/advisory/2026/03/10/crack-armor.txt (Qualys advisory)
- https://ubuntu.com/security/vulnerabilities/crackarmor (Ubuntu Security Team advisory)
 

Subject: PSA-2026-00096-1: PDM: token secrets file writable by unprivileged API daemon user​


Advisory date: 2026-11-10

Packages: proxmox-datacenter-manager

Details:

The file /etc/proxmox-datacenter-manager/token.shadow keeps the securely hashed token secrets, and needs to be readable by the unprivileged API daemon, running as www-data. The file was also writable by www-data and would thus allow modifications, in case an attacker gained access as www-data due to a different security issue.

The issue is addressed by creating the file with owner root, and changing the ownership for existing installation on upgrade.

Additionally the ownership of the configuration directory /etc/proxmox-datacenter-manager was similarly changed to root as additional future-proofing.

This issue was found internally.

Fixed in:
- proxmox-datacenter-manager >= 1.1.9
 

Subject: PSA-2026-00097-1: PDM: Authenticated SSRF via ACME Directory URL​


Advisory date: 2026-11-10

Packages: proxmox-datacenter-manager

Details:

Fetching an ACME provider's terms of service (tos) is done by the api-server. The API call was accessible by all authenticated users, allowing users with few privileges to trigger an HTTP request to a supplied URL from the Proxmox Datacenter Manager machine.

The issue is addressed by requiring System.Modify on /system/certificates as for all other ACME account endpoints.

This issue was found internally.

Fixed in:
- proxmox-datacenter-manager >= 1.1.9
 

Subject: PSA-2026-00098-1: PDM: Incomplete privilege checks for syncing users in external realms​


Advisory date: 2026-11-10

Packages: proxmox-datacenter-manager

Details:

Due to a conflicting interpretation of the used privilege-bits it was possible for a user having Access.Audit privileges to trigger a sync of a configured authentication realm.

The issue is addressed by only allowing to sync realms with the permissions needed for other modification on users - Access.Modify.

This issue was found internally.

Fixed in:
- proxmox-datacenter-manager >= 1.1.9
 

Subject: PSA-2026-00099-1: Incomplete validation of UPID when handling "stop task" API requests​


Advisory date: 2026-11-10

Packages: proxmox-backup, proxmox-datacenter-manager, proxmox-rest-server

Details:

A forged UPID value could be used to trick the API handling daemons into stopping a task worker that does not belong to the requesting user.

This issue was reported privately by Project Loupe.

Fixed in:
- librust-proxmox-rest-server-dev >= 1.1.1-1
- proxmox-backup-server >= 4.2.7-1
- proxmox-datacenter-manager >= 1.1.8
 
Status
Not open for further replies.
Top Bottom
Back