Proxmox Virtual Environment (VE) Vulnerabilities & Security Advisories
13 advisories tracked · Proxmox Security Advisories + NVD · 0 listed in the CISA Known Exploited Vulnerabilities catalog
Every row below is a published Proxmox advisory that VulniPulse classified as Virtual Environment (VE), with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 3 critical, 4 high, 6 medium.
Android app · Google Play
Monitor Proxmox CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Source
Proxmox Security Advisories + NVD
Proxmox posts security advisories on its forum (no machine-readable feed) and its CVEs are assigned by MITRE / researchers rather than a Proxmox CNA — so VulniPulse ingests them from NVD (keyword-filtered to Proxmox, dropped unless a Proxmox product is named). Covers Proxmox Virtual Environment (VE), Proxmox Backup Server (PBS) and Proxmox Mail Gateway (PMG) — the homelab and SMB virtualization stack, complementing VMware/Omnissa coverage.
Latest Proxmox Virtual Environment (VE) advisories
Critical [CVE-2023-54391] Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value in the API login endpoint
Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value in the API login endpoint. Attackers can send a POST request to the access ticket API endpoint with any value in the tfa-challenge parameter to completely skip password verification, gaining unauthorized access including to the root@pam account. All affected releases are end of life.
Critical [CVE-2022-31358] reflected cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment prior to v7.2-3
A reflected cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment prior to v7.2-3 allows remote attackers to execute arbitrary web scripts or HTML via non-existent endpoints under path /api2/html/.
Critical [CVE-2022-35508] Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) are vulnerable to SSRF
Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) are vulnerable to SSRF when proxying HTTP requests between pve(pmg)proxy and pve(pmg)daemon. An attacker with an unprivileged account can craft an HTTP request to achieve SSRF and file disclosure of any files on the server. Also, in Proxmox Mail Gateway, privilege escalation to the root@pam account is possible if the backup feature has ever been used, because backup files such as pmg-backup_YYYY_MM_DD_*.tgz have 0644 permissions and contain an authkey value. This is fixed in pve-http-server 4.1-3.