PSA-2026-00064: Proxmox Mail Gateway: Administrator to root privilege escalation via private keys in backup
This Proxmox advisory covers a security issue in Proxmox Mail Gateway.
Key facts
- Fixed in
- pmg-api 9.1.3
- Advisory id
- PSA-2026-00064
- Source published
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
Description
A user with Administrator role could create and download a backup, which includes the private key material for the API server. This can be used to forge a session as the root@pam user.
Since the host where a backup is being restored already has its own set of authentication keys, and any derived values are only valid temporarily, not including them in the backup both improves post-restore behaviour of the system, and prevents leaking of the keys used by the backed-up system. The issue was privately reported by Điềm from VNPT-VCI.
Packages: pmg-api.
Affected product named by the advisory: Proxmox Mail Gateway.
Text from the source record.
Fix and mitigation
Upgrade to a fixed release named by Proxmox:
- pmg-api 9.1.3
Vendor guidance
- Update to the fixed package versions: pmg-api >= 9.1.3.
End-of-life dates for Proxmox Mail Gateway
More Proxmox advisories
CVE-2026-116264Nov 10, 2026Proxmox Mail Gateway: Several issues in libmime-tools-perlPSA-2026-00090Nov 10, 2026Proxmox Mail Gateway: XSS in content-type display in quarantine viewsPSA-2026-00089Nov 10, 2026Proxmox: Several issues in libpve-http-server-perlPSA-2026-00065Oct 7, 2026Proxmox Mail Gateway: Bypass DMARC check by spoofed envelope sender headerPSA-2026-00063Oct 7, 2026Proxmox Mail Gateway: Administrator to root privilege escalationPSA-2026-00099Nov 10, 2026Proxmox: Incomplete validation of UPID when handling "stop task" API requests
Get an email when Proxmox Mail Gateway (PMG) publishes the next one.
See Proxmox Mail Gateway (PMG)'s last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor Proxmox Proxmox Mail Gateway from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
