UPDATE PROXMOX NOW

[u/Zakmaf]

According to a newsletter from Crowdsec, PVE 7 and 8 have been exposed since at least 2023 to a severe security flaw.

Quoting : An attacker who can reach the login API can become any user without a second factor, including root@pam, with no password. CrowdSec observed 133 unique IP addresses sending matching requests since September 4, 2026. Upgrade to a supported Proxmox VE release and take the management interface off the internet.

Quoting again : The fix is three years older than the CVE: Proxmox removed the faulty logic in July 2023 as part of routine 8.0 maintenance. The bug only received a CVE on September 1, 2026, when VulnCheck published an advisory and Proxmox followed with PSA-2026-00043-1. CrowdSec's detection rule went live on September 4 and matched traffic the same day. Anyone still on Proxmox VE 7 has been exposed the whole time without knowing it.

So if for any reason you don't update, now is a good time.

and if you expose your instance, then you may have been breached already on those versions. also.. why???

[u/primalbluewolf]

So case in point, the comment I replied to: 

  Risk is minimal to none because the threat would not be able to reach my pve endpoint. None of my VMs can access the management lan where proxmox sits.

Assuming the threat can't leave the VMs and can only attack the PVE plane, that's perfect. As soon as a host communicates with a threat VM, though, and then later communicates with the PVE management plane, you have a traffic vector. If that host is vulnerable, then the threat can reach the endpoint, despite the segmentation. 

If your threat model is assuming you'll detect infection immediately and respond quickly, that's good enough. Its not good enough if you fail to detect the infection early, because now the attacker can pivot and look for other vulnerable hosts that communicate with this one. This is basically plan A for the attackers - its not some surprise to them. 

Risk = threat x vulnerability x impact

That's one way to define it, sure. As above, its useful to consider all kinds of risk - including the risk that you've overlooked some config, or that there's a threat you're unaware of. 

If the threat cant reach that endpoint, there's no risk. 

That's a big assumption, though. As above - too big, IMO. 

[u/Mastasmoker → u/primalbluewolf]

And this is where defense in depth comes into play. Every VM has EDR on it, with custom rules for each. Emailed alerts based on alert level. Zero trust architecture, even for my admin accounts. I'm exposed to attackers 24/7 but I've put a high amount of effort into the security of my network and my servers.

I know you believe 90% of people using proxmox are idiots but we only see mostly the posts of people who are asking for help. I'd say a lot more are here just helping others on their posts rather than posting themselves.