Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth

[dsql]

I 100% agree with the patching, backups and firewall requirements. This has been the absolute minimum for perhaps 30+ years. But there are also some additional aspects, such as network isolation, PAWs/SAWs, the concept of least privilege, IDS/IPS, etc. These are becoming more and more critical as the years go by.

- VLANs and firewall rules to fully isolate users, IT staff, wireless guests, etc. from each other and from all core systems.
- Management of infrastructure should only be accessible by using dedicated workstations with accounts separate from daily-use accounts (MFA preferred), and everyone only has permissions/access to the absolute minimum to do their job.
- Set up alerts for unusual activity, as well as automatically block any repeated attempts to gain access.
- Hire someone to do pen-testing or at least an audit to help catch any blind spots or shame management decisions made for political reasons (I'm the boss, give me admin on everything!). There is also end-user training which can be critical to detect and prevent various attacks.

This is all nice in enterprise, but for a lot of the people reporting an incident, they are OVH customers who used the one-click installation of proxmox with zero knowledge outside of that. Some are restricted to IPMI / WireGuard / CF being their only options for true isolation.

Given this was the shape of a 0-day, where the CVE was only now just issued, many were just caught blind.

 

[J-Rod]

No, if you can't set up things correctly, then go find another hobby. This is the reason why these attacks are still so popular and lucrative.

 

[Johannes S]

This is all nice in enterprise, but for a lot of the people reporting an incident, they are OVH customers who used the one-click installation of proxmox with zero knowledge outside of that. Some are restricted to IPMI / WireGuard / CF being their only options for true isolation.

Does OVH really deploy PVE7 still in 2026? Or isn't it more that folks start with some version and then never update due to the non-dying "never change a running system"-bullshit? And since you mention wireguard: If that's available why don't they use it? "Zero knowledge" doesn't excuse lazyness

Given this was the shape of a 0-day, where the CVE was only now just issued, many were just caught blind.

And they wouldn't if they wouldn't have run EOL software. If you have zero knowledge you shouldn't run servers exposed to the Internet. Given that stuff like tailscale/netbird/pangolin/cloudfare tunnels are available there is no reason why anybody should expose stuff on the internet.

 

[proxuser77]

Fascinating. It’s the year 2026, and people are still having seven-page-long discussions about something that could have been prevented by following two simple rules that everyone should know by now.

1. Keep the software up to date and don't use end-of-life software!

2. Don't expose management interfaces to the internet!

Rule #1 especially is non-negotiable if you operate any kind of network-connected device. Anyone who doesn’t follow this rule is essentially asking to get pwned. It's as simple as that.

 

[dsql]

Does OVH really deploy PVE7 still in 2026? Or isn't it more that folks start with some version and then never update due to the non-dying "never change a running system"-bullshit? And since you mention wireguard: If that's available why don't they use it? "Zero knowledge" doesn't excuse lazyness

OVH deploys PVE8 last I saw, unsure about presently.
I think there is a disconnect, that mass providers like OVH with 1-click installation have lowered the barrier to entry to using software such as PVE widely.

From some of the people I spoke to who were impacted by this, they either didn't even know they could SSH into the server to patch major versions, or assumed the UI gave them everything they needed. I agree it doesn't excuse laziness, but, "you don't know what you don't know" is also a thing. Some of people genuinely have no idea.

Software (such as PVE) has just become so much more consumable by people who otherwise don't know anything past the surface. Even some of the folks in this thread asking for help, you can tell they do not know the full extent of their software, nor how much is exposed by keeping UI interfaces on public nets. I do agree, it is 100% the consumers fault.

I just think the whole point and laugh + gatekeep response that happens on forums like this get is why people don't ask for help until it is too late lol.

And they wouldn't if they wouldn't have run EOL software. If you have zero knowledge you shouldn't run servers exposed to the Internet. Given that stuff like tailscale/netbird/pangolin/cloudfare tunnels are available there is no reason why anybody should expose stuff on the internet.

Yeah modern day software has made this less of an issue, again, agreed.

 

[proxuser77]

OVH deploys PVE8 last I saw, unsure about presently.
I think there is a disconnect, that mass providers like OVH with 1-click installation have lowered the barrier to entry to using software such as PVE widely.

From some of the people I spoke to who were impacted by this, they either didn't even know they could SSH into the server to patch major versions, or assumed the UI gave them everything they needed. I agree it doesn't excuse laziness, but, "you don't know what you don't know" is also a thing. Some of people genuinely have no idea.

Software (such as PVE) has just become so much more consumable by people who otherwise don't know anything past the surface. Even some of the folks in this thread asking for help, you can tell they do not know the full extent of their software, nor how much is exposed by keeping UI interfaces on public nets. I do agree, it is 100% the consumers fault.

I just think the whole point and laugh + gatekeep response that happens on forums like this get is why people don't ask for help until it is too late lol.

In my opinion, that isn't an excuse anymore by 2026. Even the mainstream media constantly emphasizes these days that you should keep your devices and software up to date. Everyone knows that, no matter how tech-savvy they are. How could anyone believe that this should be any different for a hypervisor, with a management interface that is exposed to the Internet ;-)

And no, the one-click installer is no excuse for not educating yourself on how to keep it up to date either. And even if OMV were to depploy an EOL version, that shouldn’t stop you from updating it. Keeping software up to date is really the bare minimum that everyone with any internet-connected device should do; anyone who fails to do so and continues to use unpatched and/or EOL software really has only themselves to blame.

This may sound harsh, but again, it’s 2026, and every kid knows you’re supposed to install software updates.

 

[Johannes S]

OVH deploys PVE8 last I saw, unsure about presently.

Yikes, not a good look on a Proxmox hosting partner ): I wonder now, whether the Proxmox team expect hosting partners to hold some standards?

I just think the whole point and laugh + gatekeep response that happens on forums like this get is why people don't ask for help until it is too late lol.

I don't think that "gatekeeping" is a bad thing per se. I mean not everybody is allowed to push to Debians gitlab, you can submit patches to Linux kernel developers but they won't merge them without review etc pp. And I definitively don't want to discourage people from asking for help. But I think there is a difference between "asking for help" and fafo

I always considered the "one-click" options of OVH and other cloud providers as quality-of-life feature for convenience, not to enable people without clue to shoot themselves in the foot. After all in most providers you can still do a custom install with a iso you upload on your own.

 

[dsql]

Yikes, not a good look on a Proxmox hosting partner ): I wonder now, whether the Proxmox team expect hosting partners to hold some standards?



I don't think that "gatekeeping" is a bad thing per se. I mean not everybody is allowed to push to Debians gitlab, you can submit patches to Linux kernel developers but they won't merge them without review etc pp. And I definitively don't want to discourage people from asking for help. But I think there is a difference between "asking for help" and fafo

I always considered the "one-click" options of OVH and other cloud providers as quality-of-life feature for convenience, not to enable people without clue to shoot themselves in the foot. After all in most providers you can still do a custom install with a iso you upload on your own.

I remember being like 13-15 trying to figure out wtf IPMI was and why my java installation wasn't compatible trying to upload ESXi. Re-installing Debian over and over because I botched something and didn't know how to recover lol. Definitely made me way more aware than a "one-click" installer does these days, that is for sure.

OVH may have gotten rid of PVE 8 by now, EOL just ended on it so I think their cut off is around the time it ends. It was definitely an option in early August.
Honestly, I think a big issue with OVH + this PVE exploit is the sheer amount of struggle to update on OVH. I was poking around the forums as I just signed up, and saw threads like this one https://forum.proxmox.com/threads/proxmox-ve-8-to-9-on-ovh-bare-metal-servers.169924/

That default installation they do is sometimes brutal. Not to mention, going for the update, you set off all types of their alerting and monitoring alarm bells. One client I spoke to this week told me they stopped an update because OVH started an "intervention" on their server and they thought they did something wrong

 

[Johannes S]

Or to be more precise: I'm willing to excuse people who are running stuff on OVH for some hobby or pasttime activities (e.G. minecraft gaming servers, your familys nextcloud, whatever, your sports club forum etc pp).
But if you are a company (even a small or middle business like a small web design agency who use the ovh host for hosting the websites for their customers) who use this to host services for your customers I expect you to be able fullfill basic requirements like the ones pointed out by @J-Rod plus 3-2-1-rule fullfilling backups. If you don't know how to do this but want to do business non the less: Yes, then I'm definitively in favour of gatekeeping you from doing this. Hetzner for example is quite notorious for their automated abuse handling which can led to loosing your customer account if you get owned and don't react fast enough or something else looks shady. The Internet would be a better place if more providers handle abuse management the same.

 

[Carlos Gomes]

can you share the PT telegram group?

sure - https://t.me/ProxmoxBrasil

 

[Emily Garrison]

This is a good reminder that having a strong password isn't enough when the underlying system is no longer receiving security updates. I think it's especially easy to overlook this with older homelab installations that have been running reliably for years.

For anyone still running an older Proxmox version, checking the support status, keeping the host updated, limiting internet exposure, and having tested backups seems like a good minimum starting point.

The part about the system being exposed while traveling is also a useful reminder to double-check firewall rules after making temporary changes. It's easy to forget about something like that later.

Hopefully this discussion helps other users avoid a similar situation.

 

[proxuser77]

The part about the system being exposed while traveling is also a useful reminder to double-check firewall rules after making temporary changes. It's easy to forget about something like that later.

I think a VPN would be a better solution here. If a zero-day vulnerability is discovered and an exploit released *while* you’re travelling, closing the port again after you’ve already been compromised won’t help.

Naturally, some services must be publicly accessible by their very nature, such as public websites. Management interfaces, however, do not fall into this category. And, of course, if you are hosting public services on your hypervisor, it is even more important to keep everything up to date and secure. In that case, it is probably wise to implement additional security measures besides just keeping everything up to date.

Otherwise, I totally agree. What you’re describing is the bare minimum one should do when running a server. Plus, as I said before, keeping things up to date actually applies to all electronic devices today that are connected to the internet. If updates are no longer available, you should at least disconnect them, or, if they only work with an Internet connection, you should probably just scrap them.

 

[tom]

Yikes, not a good look on a Proxmox hosting partner ): I wonder now, whether the Proxmox team expect hosting partners to hold some standards?

Hosting partners have to comply with our standards. Please check the list on:

https://proxmox.com/en/partners/fin...-type-filter/partner-type/hosting-partner?f=6

 

[CRCinAU]

The Australian Signals Directorate has a process called the Essential Eight. Its' basically:

The Eight Mitigation Strategies​

According to ASD’s official guidance, the Essential Eight consists of:

1. Patch applications – Apply security updates to software promptly.
2. Patch operating systems – Keep OS versions updated to reduce vulnerabilities.
3. Multi‑factor authentication (MFA) – Require additional verification for logins.
4. Restrict administrative privileges – Limit admin rights to reduce misuse.
5. Application control – Allow only approved applications to run.
6. Restrict Microsoft Office macros – Block or tightly control macro execution.
7. User application hardening – Disable risky features in applications (e.g., Flash, ads, Java in browsers).
8. Regular backups – Maintain and test backups to ensure data recovery

There is a lot more detail of the Essential Eight here: https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight

That being said, even end users and none techie people would be wise to at least have a basic understanding on the general drift of what these mean for the average person - even if its only parts 1, 2, 3, and 8. If you use a computer, you should know at least these to keep yourself somewhat safer in todays world.

 

[Carlos Gomes]

Hosting partners have to comply with our standards. Please check the list on:

https://proxmox.com/en/partners/fin...-type-filter/partner-type/hosting-partner?f=6

Very interesting to note that most of the hosting we heard of complains (hertzner, OVH, virtualizor, Locaweb, etc) are not in the list of partners, and for the special case of the wildfire spread in Brasil was mostly for this kind of hosting that do not take care or have any alignment with Proxmox itself, or let the users handle fully the management thenselfs.

What makes sense in colocation setups, or if its clear who owns what regarding maintenance and responsability of keeping the systems up to date and with proper environments.

So take care if you are using a freestyle-hosting provider, or have full ownership of your environment. Please do not blame Proxmox itself for your bad managed environments or amateurish low cost providers.

 

[CRCinAU]

In some semi-related news, I'm surprised that given both the domain name and web service of one of the malware droppers both go through Cloudflare that nothing has been taken down by Cloudflare yet.

I've reached out to CF to see if we can get these services looked at - as its highly likely that this may at least cause SOME of the systems to not be functional after spreading. Yes, probably circumvented pretty easily - but limiting blast radius is *always* a good thing.

 

[proxuser77]

Very interesting to note that most of the hosting we heard of complains (hertzner, OVH, virtualizor, Locaweb, etc) are not in the list of partners, and for the special case of the wildfire spread in Brasil was mostly for this kind of hosting that do not take care or have any alignment with Proxmox itself, or let the users handle fully the management thenselfs.

What makes sense in colocation setups, or if its clear who owns what regarding maintenance and responsability of keeping the systems up to date and with proper environments.

So take care if you are using a freestyle-hosting provider, or have full ownership of your environment. Please do not blame Proxmox itself for your bad managed environments or amateurish low cost providers.

I don't use OVH myself, but I do use other VPS/server providers. With them, these VMs or servers are usually set up with the chosen OS in a fairly basic configuration. You are then responsible for securing them and keeping them up to date. The fact that you can order a Proxmox server with "one click" (alongside various other Linux distributions, operating systems and hypervisors) doesn't mean that you don't have to worry about anything once the server is up and running. For example, with a standard Debian installation, often not even a password for sudo is set up. With some providers, you even needed to initially log in directly as root with a password and then had to create a user yourself, upload SSH keys, and so on.

And yes, as far as I can tell, they aren’t partners, but I don't necessarily see that as an issue. As I said, they simply offer Proxmox alongside other distributions, operating systems and hypervisors, such as Hyper-V and ESXi. However, I wouldn’t describe OMH, Hetzner, etc. as 'amateurish' because of that; they're geared more towards price-conscious users who know what they're doing.

Btw, you can also configure AWS or Azure insecurely, or never update your VMs and applications running there, and although I’m no fan of these big tech companies, I definitely wouldn’t call them amateurish.

Managed or SaaS offerings are, of course, better suited to users with little experience of servers who don't want to worry about anything. However, it would probably be even better for those users to use SaaS products for the actual applications they want to use, rather than a managed Proxmox server. I mean, If they're not going to update the hypervisor, I kinda doubt that things will look much better for the operating systems and applications running in the VMs and containers on this Proxmox host.

 

[Johannes S]

Managed or SaaS offerings are, of course, better suited to users with little experience of servers who don't want to worry about anything.

So much this. I'm a big fan of uberspace, they provide shared webhosting as a service for around 10€ per month. You won't have as much storage space as on a hetzner or netcup vserver and can't do anything needing root. But you can install any software of your choice in your personal user directory, get a personal mysql and a shell login via ssh. Together with some wrapper scripts you end up with e.g. a WordPress instance which might still be insecure ( being WordPress after all) but you only need to update WordPress, everything else is done by them. Their setup is quite interesting ( and relevant to our discussion ) They run an ProxmoxVE cluster with Centos7/8 vms as webservers. Now CentOs6/8 is EOL too, so they have a maintenance contract with another service provider and planning to migrate their workloads to arch. Their blog ( although in German) blog.uberspace.de is quite worth a read, they also describe from time to time how they try to help their customers ( which include web design agency's and freelancers who might know their bash but have at best average skills in running linux systems securely) o keep their webservices secure even with known issues.

With other words: IMHO they doing a quite good job but it comes with a price tag. For the same price you could also rent some vserver which would give you more resources, more storage and more flexibility. And more work too.

 

[Johannes S]

Very interesting to note that most of the hosting we heard of complains (hertzner, OVH, virtualizor, Locaweb, etc) are not in the list of partners

That's interesting, OVH used to be it if I understand correctly ( https://pve.proxmox.com/wiki/OVH ) but isn't anymore. Propably better that way anyhow although somewhere in this thread somebody mentioned that new machines get PVE9 now at ovh.

For example, with a standard Debian installation, often not even a password for sudo is set up.

Yes this is true for most cloudd-init based images of major distributions but in my book this isn't an issue per se. If you can upload your schedule key before launching the instance you can usually only login with your ssh-key ( password login is prohibited). Then being able to do a sudo -i to get a root shell without password isn't that much of a difference compared to sshing as root with key authentification.

For better security ssh-certificates provided only after login ( with 2fa) to an identity-provider like keykloak would achieve more than having to enter a password for sudo:
https://smallstep.com/blog/use-ssh-certificates/

Because if you have at lot of vms ( we have around 300 at work) you would need a different sudo password on all machines for actually improving security which woukd make management at scale quite difficult. So a certificate+I'd provider approach would be a big improvement.
We are not there yet for the usual reasons ( to many urgent matters and not enough time ).

 

[proxuser77]

So much this. I'm a big fan of uberspace, they provide shared webhosting as a service for around 10€ per month.

I mean, the best hosting option varies depending on the use case, but yes, shared hosting providers are still a good option for hosting applications like WordPress or basic PHP applications. However, and I don’t know Uberspace, but in my experience, with many modern applications that aren’t PHP-based, and even with Nextcloud, which is still based on PHP, you’ll hit limitations pretty quickly or won’t be able to run them at all. And, unless it’s a managed WordPress hosting, you obviously still have to take care of the WordPress updates yourself.

Price is, of course, a big factor, especially for home users and SMBs. The more managed or SaaS features and support you get, the more expensive it usually gets. However, as an SMB, you should carefully consider whether it's worth it to save a few euros by hosting a VPS or your own Proxmox server, especially if you don't have anyone who knows how to handle it. If you get compromised and are offline for a week, lose data because the backup didn’t work or was incomplete, or face data protection lawsuits afterward, it can quickly become much more expensive. Ransomware demands have also broken the backs of small businesses, even though ransomware gangs (at least the professional ones) actually have no interest in driving the companies they’re extorting into bankruptcy.

Anyway, the main point I was trying to make was: If you’re using a standard VPS or dedicated server, this just means that the virtual machine or server is running in a data center instead of in your own server room. This means you “only” pay for the infrastructure, which is why the service is relatively inexpensive. As a result, you’re entirely responsible for managing the server yourself.

And that’s perfectly fine, IMHO, but only if one is also willing to put in the necessary effort.