PSA-2026-00092: Proxmox Virtual Environment: Missing and incomplete ACL checks in the SDN API
This Proxmox advisory covers a security issue in Proxmox Virtual Environment.
Key facts
- Fixed in
- libpve-network-api-perl 1.6.8
- Advisory id
- PSA-2026-00092
- Source published
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
Description
Several permission checks in the SDN API were incomplete, wrong or missing: IPAM: the zone parameter was used for ACL checks, instead of the parent VNet zone. Subnets: the vnet parameter was not checked against the subnet's parent VNet.
VNets: the target zone's ACLs were not checked when moving a VNet from one zone to another. The permission checks when querying the running or pending SDN configuration were done using the current configuration, which might contain different entities with different ACLs.
The existence of zones, VNets and subnets was revealed via error messages, even if the querying user does not have access to them. It was not, but is now required to have the SDN.Use or SDN.Allocate privilege on DNS and IPAM plugins, controllers, fabrics, route maps and prefix lists for referencing them in zones, controllers, fabrics and route maps.
Users who manage zones may need this privilege added, for example on '/sdn/ipams/pve' for the default IPAM. Some of these issues were privately reported by Geoffrey McClinsey.
Packages: libpve-network-api-perl.
Affected product named by the advisory: Proxmox Virtual Environment.
Text from the source record.
Fix and mitigation
Upgrade to a fixed release named by Proxmox:
- libpve-network-api-perl 1.6.8
Vendor guidance
- Update to the fixed package versions: libpve-network-api-perl >= 1.6.8.
Support dates for the fixed release lines
- Proxmox VE 1: support ended
More Proxmox advisories
PSA-2026-00095Nov 10, 2026Proxmox Virtual Environment: Broken privilege checks when modifying container NICsPSA-2026-00094Nov 10, 2026Proxmox Virtual Environment: OCI extraction path escapePSA-2026-00093Nov 10, 2026Proxmox Virtual Environment: FRR config injection issuesPSA-2026-00089Nov 10, 2026Proxmox: Several issues in libpve-http-server-perlPSA-2026-00088Nov 10, 2026Proxmox Virtual Environment: Shell command injection via volume namePSA-2026-00085Nov 3, 2026Proxmox Virtual Environment: Incomplete privilege checks for outgoing remote migration
Get an email when Proxmox Virtual Environment (VE) publishes the next one.
See Proxmox Virtual Environment (VE)'s last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor Proxmox Proxmox Virtual Environment from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
