PSA-2026-00063: Proxmox Mail Gateway: Administrator to root privilege escalation via http_proxy configuration setting
This Proxmox advisory covers a security issue in Proxmox Mail Gateway.
Key facts
- Fixed in
- pmg-api 9.1.3
- Advisory id
- PSA-2026-00063
- Source published
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
Description
Insufficient input validation for the http_proxy configuration setting allowed an attacker with Administrator role to inject arbitrary contents into the /etc/apt/apt.conf.d/76pmgproxy configuration file. In particular, an APT::Update::Pre-Invoke setting is executed as the root user during package update, allowing for arbitrary command execution as root.
The issue was addressed by restricting setting http_proxy to root@pam and by parsing the setting more strictly. This issue was privately reported by: Vo Van Phuc - VNPT Cyber Immunity (VCI) Diem - VNPT Cyber Immunity (VCI) Packages: pmg-api.
Affected product named by the advisory: Proxmox Mail Gateway.
Text from the source record.
Fix and mitigation
Upgrade to a fixed release named by Proxmox:
- pmg-api 9.1.3
Vendor guidance
- Update to the fixed package versions: pmg-api >= 9.1.3.
End-of-life dates for Proxmox Mail Gateway
More Proxmox advisories
CVE-2026-116264Nov 10, 2026Proxmox Mail Gateway: Several issues in libmime-tools-perlPSA-2026-00090Nov 10, 2026Proxmox Mail Gateway: XSS in content-type display in quarantine viewsPSA-2026-00089Nov 10, 2026Proxmox: Several issues in libpve-http-server-perlPSA-2026-00065Oct 7, 2026Proxmox Mail Gateway: Bypass DMARC check by spoofed envelope sender headerPSA-2026-00064Oct 7, 2026Proxmox Mail Gateway: Administrator to root privilege escalationPSA-2026-00099Nov 10, 2026Proxmox: Incomplete validation of UPID when handling "stop task" API requests
Get an email when Proxmox Mail Gateway (PMG) publishes the next one.
See Proxmox Mail Gateway (PMG)'s last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor Proxmox Proxmox Mail Gateway from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
