Proxmox vuneralbilities according to Wazuh

[Cesar da Silva]

I am using Wazuh to monitor my systems, and I got information that Proxmox (with the latest updates) are vunerebale to the following CVE:s:
CVE-2025-69720
CVE-2006-10003
CVE-2026-32746

Can you confirm it or maybe fix it in comming updates?

 

[gurubert]

CVE-2026-32746 affects telnetd. Do you have telnetd installed or even enabled on any of your machines?

 

[santiagobiali]

CVE-2025-69720 and CVE-2006-10003 refer to these packages: libncurses6 libncursesw6 libtinfo6 libxml-parser-perl ncurses-base ncurses-bin ncurses-term, which are from debian's repository. I don't think it's a Proxmox issue, but Debian's.

CVE-2006-10003 is already patched in forky/sid, so it's just a question of time to be backported.

Oh, and just run apt remove inetutils-telnet -y in your hosts to remove telnetd in order to solve mitigate CVE-2026-32746.

 

[Onslow]

Oh, and just run apt remove inetutils-telnet -y in your hosts to remove telnetd in order to solve mitigate CVE-2026-32746.

Package inetutils-telnet contains client only, so it doesn't make the machine vulnerable.
While telnet server is delivered by other package: inetutils-telnetd

 

[santiagobiali]

Package inetutils-telnet contains client only, so it doesn't make the machine vulnerable.

Corrrect, but Wazuh also tags it as vulnerable.
https://cti.wazuh.com/vulnerabiliti...+13+Trixie&affected[product]=inetutils-telnet

 

[Onslow]

Oh, indeed Wazuh is saying so. Looks very much like Wazuh's inaccuracy.
The original message from the researchers clearly states that the vulnerability is in telneld (the server):

https://lists.gnu.org/archive/html/bug-inetutils/2026-03/msg00031.html

 

[santiagobiali]

Looks very much like Wazuh's inaccuracy.

Yeah, the issue is not on the package itself. I believe Wazuh also tags it as a vulnerability because it can be used for lateral movement.

 

[bbgeek17]

CVE-2025-69720 and CVE-2006-10003 refer to these packages: libncurses6 libncursesw6 libtinfo6 libxml-parser-perl ncurses-base ncurses-bin ncurses-term, which are from debian's repository. I don't think it's a Proxmox issue, but Debian's.

Proxmox has the ability to incorporate patches and build updated packages as needed. Given that Proxmox VE is frequently deployed as an appliance, and is relied upon by many enterprise environments, there may be cases where, depending on the severity of a vulnerability, it makes sense for fixes to be prioritized and included more quickly.

If the original poster, or any paying customer, has concerns about specific open CVEs, it would be appropriate to open a Bugzilla tracking issue or submit a support case to help ensure visibility and proper prioritization.

---

Blockbridge : Ultra low latency all-NVME shared storage for Proxmox - https://www.blockbridge.com/proxmox