PSA-2026-00096: Proxmox Datacenter Manager: token secrets file writable by unprivileged API daemon user
This Proxmox advisory covers a security issue in Proxmox Datacenter Manager.
Key facts
- Fixed in
- proxmox-datacenter-manager 1.1.9
- Advisory id
- PSA-2026-00096
- Source published
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
Description
The file /etc/proxmox-datacenter-manager/token.shadow keeps the securely hashed token secrets, and needs to be readable by the unprivileged API daemon, running as www-data. The file was also writable by www-data and would thus allow modifications, in case an attacker gained access as www-data due to a different security issue.
The issue is addressed by creating the file with owner root, and changing the ownership for existing installation on upgrade. Additionally the ownership of the configuration directory /etc/proxmox-datacenter-manager was similarly changed to root as additional future-proofing.
This issue was found internally.
Text from the source record.
Fix and mitigation
Upgrade to a fixed release named by Proxmox:
- proxmox-datacenter-manager 1.1.9
Vendor guidance
- Update to the fixed package versions: proxmox-datacenter-manager >= 1.1.9.
More Proxmox advisories
PSA-2026-00099Nov 10, 2026Proxmox: Incomplete validation of UPID when handling "stop task" API requestsPSA-2026-00098Nov 10, 2026Proxmox Datacenter Manager: Incomplete privilege checks for syncing users in externalPSA-2026-00097Nov 10, 2026Proxmox Datacenter Manager: Authenticated SSRF via ACME Directory URLPSA-2026-00095Nov 10, 2026Proxmox Virtual Environment: Broken privilege checks when modifying container NICsPSA-2026-00094Nov 10, 2026Proxmox Virtual Environment: OCI extraction path escapePSA-2026-00093Nov 10, 2026Proxmox Virtual Environment: FRR config injection issues
Get an email when Proxmox publishes the next one.
See Proxmox's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor Proxmox Proxmox Datacenter Manager from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
