Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth

[dsql]

I 100% agree with the patching, backups and firewall requirements. This has been the absolute minimum for perhaps 30+ years. But there are also some additional aspects, such as network isolation, PAWs/SAWs, the concept of least privilege, IDS/IPS, etc. These are becoming more and more critical as the years go by.

- VLANs and firewall rules to fully isolate users, IT staff, wireless guests, etc. from each other and from all core systems.
- Management of infrastructure should only be accessible by using dedicated workstations with accounts separate from daily-use accounts (MFA preferred), and everyone only has permissions/access to the absolute minimum to do their job.
- Set up alerts for unusual activity, as well as automatically block any repeated attempts to gain access.
- Hire someone to do pen-testing or at least an audit to help catch any blind spots or shame management decisions made for political reasons (I'm the boss, give me admin on everything!). There is also end-user training which can be critical to detect and prevent various attacks.

This is all nice in enterprise, but for a lot of the people reporting an incident, they are OVH customers who used the one-click installation of proxmox with zero knowledge outside of that. Some are restricted to IPMI / WireGuard / CF being their only options for true isolation.

Given this was the shape of a 0-day, where the CVE was only now just issued, many were just caught blind.

 

[J-Rod]

No, if you can't set up things correctly, then go find another hobby. This is the reason why these attacks are still so popular and lucrative.

 

[Johannes S]

This is all nice in enterprise, but for a lot of the people reporting an incident, they are OVH customers who used the one-click installation of proxmox with zero knowledge outside of that. Some are restricted to IPMI / WireGuard / CF being their only options for true isolation.

Does OVH really deploy PVE7 still in 2026? Or isn't it more that folks start with some version and then never update due to the non-dying "never change a running system"-bullshit? And since you mention wireguard: If that's available why don't they use it? "Zero knowledge" doesn't excuse lazyness

Given this was the shape of a 0-day, where the CVE was only now just issued, many were just caught blind.

And they wouldn't if they wouldn't have run EOL software. If you have zero knowledge you shouldn't run servers exposed to the Internet. Given that stuff like tailscale/netbird/pangolin/cloudfare tunnels are available there is no reason why anybody should expose stuff on the internet.

 

[proxuser77]

Fascinating. It’s the year 2026, and people are still having seven-page-long discussions about something that could have been prevented by following two simple rules that everyone should know by now.

1. Keep the software up to date and don't use end-of-life software!

2. Don't expose management interfaces to the internet!

Rule #1 especially is non-negotiable if you operate any kind of network-connected device. Anyone who doesn’t follow this rule is essentially asking to get pwned. It's as simple as that.

 

[dsql]

Does OVH really deploy PVE7 still in 2026? Or isn't it more that folks start with some version and then never update due to the non-dying "never change a running system"-bullshit? And since you mention wireguard: If that's available why don't they use it? "Zero knowledge" doesn't excuse lazyness

OVH deploys PVE8 last I saw, unsure about presently.
I think there is a disconnect, that mass providers like OVH with 1-click installation have lowered the barrier to entry to using software such as PVE widely.

From some of the people I spoke to who were impacted by this, they either didn't even know they could SSH into the server to patch major versions, or assumed the UI gave them everything they needed. I agree it doesn't excuse laziness, but, "you don't know what you don't know" is also a thing. Some of people genuinely have no idea.

Software (such as PVE) has just become so much more consumable by people who otherwise don't know anything past the surface. Even some of the folks in this thread asking for help, you can tell they do not know the full extent of their software, nor how much is exposed by keeping UI interfaces on public nets. I do agree, it is 100% the consumers fault.

I just think the whole point and laugh + gatekeep response that happens on forums like this get is why people don't ask for help until it is too late lol.

And they wouldn't if they wouldn't have run EOL software. If you have zero knowledge you shouldn't run servers exposed to the Internet. Given that stuff like tailscale/netbird/pangolin/cloudfare tunnels are available there is no reason why anybody should expose stuff on the internet.

Yeah modern day software has made this less of an issue, again, agreed.

 

[proxuser77]

OVH deploys PVE8 last I saw, unsure about presently.
I think there is a disconnect, that mass providers like OVH with 1-click installation have lowered the barrier to entry to using software such as PVE widely.

From some of the people I spoke to who were impacted by this, they either didn't even know they could SSH into the server to patch major versions, or assumed the UI gave them everything they needed. I agree it doesn't excuse laziness, but, "you don't know what you don't know" is also a thing. Some of people genuinely have no idea.

Software (such as PVE) has just become so much more consumable by people who otherwise don't know anything past the surface. Even some of the folks in this thread asking for help, you can tell they do not know the full extent of their software, nor how much is exposed by keeping UI interfaces on public nets. I do agree, it is 100% the consumers fault.

I just think the whole point and laugh + gatekeep response that happens on forums like this get is why people don't ask for help until it is too late lol.

In my opinion, that isn't an excuse anymore by 2026. Even the mainstream media constantly emphasizes these days that you should keep your devices and software up to date. Everyone knows that, no matter how tech-savvy they are. How could anyone believe that this should be any different for a hypervisor, with a management interface that is exposed to the Internet ;-)

And no, the one-click installer is no excuse for not educating yourself on how to keep it up to date either. And even if OMV were to depploy an EOL version, that shouldn’t stop you from updating it. Keeping software up to date is really the bare minimum that everyone with any internet-connected device should do; anyone who fails to do so and continues to use unpatched and/or EOL software really has only themselves to blame.

This may sound harsh, but again, it’s 2026, and every kid knows you’re supposed to install software updates.

 

[Johannes S]

OVH deploys PVE8 last I saw, unsure about presently.

Yikes, not a good look on a Proxmox hosting partner ): I wonder now, whether the Proxmox team expect hosting partners to hold some standards?

I just think the whole point and laugh + gatekeep response that happens on forums like this get is why people don't ask for help until it is too late lol.

I don't think that "gatekeeping" is a bad thing per se. I mean not everybody is allowed to push to Debians gitlab, you can submit patches to Linux kernel developers but they won't merge them without review etc pp. And I definitively don't want to discourage people from asking for help. But I think there is a difference between "asking for help" and fafo

I always considered the "one-click" options of OVH and other cloud providers as quality-of-life feature for convenience, not to enable people without clue to shoot themselves in the foot. After all in most providers you can still do a custom install with a iso you upload on your own.

 

[dsql]

Yikes, not a good look on a Proxmox hosting partner ): I wonder now, whether the Proxmox team expect hosting partners to hold some standards?



I don't think that "gatekeeping" is a bad thing per se. I mean not everybody is allowed to push to Debians gitlab, you can submit patches to Linux kernel developers but they won't merge them without review etc pp. And I definitively don't want to discourage people from asking for help. But I think there is a difference between "asking for help" and fafo

I always considered the "one-click" options of OVH and other cloud providers as quality-of-life feature for convenience, not to enable people without clue to shoot themselves in the foot. After all in most providers you can still do a custom install with a iso you upload on your own.

I remember being like 13-15 trying to figure out wtf IPMI was and why my java installation wasn't compatible trying to upload ESXi. Re-installing Debian over and over because I botched something and didn't know how to recover lol. Definitely made me way more aware than a "one-click" installer does these days, that is for sure.

OVH may have gotten rid of PVE 8 by now, EOL just ended on it so I think their cut off is around the time it ends. It was definitely an option in early August.
Honestly, I think a big issue with OVH + this PVE exploit is the sheer amount of struggle to update on OVH. I was poking around the forums as I just signed up, and saw threads like this one https://forum.proxmox.com/threads/proxmox-ve-8-to-9-on-ovh-bare-metal-servers.169924/

That default installation they do is sometimes brutal. Not to mention, going for the update, you set off all types of their alerting and monitoring alarm bells. One client I spoke to this week told me they stopped an update because OVH started an "intervention" on their server and they thought they did something wrong

 

[Johannes S]

Or to be more precise: I'm willing to excuse people who are running stuff on OVH for some hobby or pasttime activities (e.G. minecraft gaming servers, your familys nextcloud, whatever, your sports club forum etc pp).
But if you are a company (even a small or middle business like a small web design agency who use the ovh host for hosting the websites for their customers) who use this to host services for your customers I expect you to be able fullfill basic requirements like the ones pointed out by @J-Rod plus 3-2-1-rule fullfilling backups. If you don't know how to do this but want to do business non the less: Yes, then I'm definitively in favour of gatekeeping you from doing this. Hetzner for example is quite notorious for their automated abuse handling which can led to loosing your customer account if you get owned and don't react fast enough or something else looks shady. The Internet would be a better place if more providers handle abuse management the same.

 

[Carlos Gomes]

can you share the PT telegram group?

sure - https://t.me/ProxmoxBrasil