PSA-2026-00065: Proxmox Mail Gateway: Bypass DMARC check by spoofed envelope sender header
This Proxmox advisory covers a security issue in Proxmox Mail Gateway.
Key facts
- Fixed in
- pmg-api 9.1.3
- Advisory id
- PSA-2026-00065
- Source published
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
Description
Adding a X-Proxmox-Envelope-From header to a mail confuses pmg-smtp-filter into using the mail-address there, instead of the actual envelope sender for the DMARC alignment check. Sending a mail with valid SPF result from one domain can yield a pass result for the strict DMARC policy of a different domain, effectively bypassing DMARC.
The issue is addressed, by passing the envelope sender address directly to SpamAssassin instead of by adding a X-Proxmox-Envelope-From header before parsing. This also modifies the template for SpamAssassin's local.cf configuration file.
If you have a modified /etc/pmg/templates/local.cf.in make sure to adapt it to the removal of envelope_sender_header X-Proxmox-Envelope-From. The issue was privately reported by Gabriele Caniglia, NetRelay.
Packages: pmg-api.
Affected product named by the advisory: Proxmox Mail Gateway.
Text from the source record.
Fix and mitigation
Upgrade to a fixed release named by Proxmox:
- pmg-api 9.1.3
Vendor guidance
- Update to the fixed package versions: pmg-api >= 9.1.3.
End-of-life dates for Proxmox Mail Gateway
More Proxmox advisories
CVE-2026-116264Nov 10, 2026Proxmox Mail Gateway: Several issues in libmime-tools-perlPSA-2026-00090Nov 10, 2026Proxmox Mail Gateway: XSS in content-type display in quarantine viewsPSA-2026-00089Nov 10, 2026Proxmox: Several issues in libpve-http-server-perlPSA-2026-00064Oct 7, 2026Proxmox Mail Gateway: Administrator to root privilege escalationPSA-2026-00063Oct 7, 2026Proxmox Mail Gateway: Administrator to root privilege escalationPSA-2026-00099Nov 10, 2026Proxmox: Incomplete validation of UPID when handling "stop task" API requests
Get an email when Proxmox Mail Gateway (PMG) publishes the next one.
See Proxmox Mail Gateway (PMG)'s last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor Proxmox Proxmox Mail Gateway from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
