CVE-2026-16658

{}

{}

{}

{"acknowledgement": "Red Hat would like to thank Jake Badoino for reporting this issue.", "bugzilla": {"description": "community.proxmox: community.general: community.proxmox: proxmox_pct_remote shel injection via unquoted pct exec command allows", "id": "2506209", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506209"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-78", "details": ["A flaw was found in the community.proxmox Ansible collection's\nproxmox_pct_remote connection plugin. The _build_pct_command()\nmethod constructs a pct exec command string using unquoted string\nconcatenation and passes it to the Proxmox host's shell via\nParamiko. Shell metacharacters in the command (such as >, |, ;, &&,\nor $()) are interpreted on the host instead of inside the target\nLXC container, allowing commands intended for an unprivileged\ncontainer to execute on the hypervisor host as root. This\nconstitutes a container-to-host trust boundary crossing. The\nput_file and fetch_file methods in the same plugin correctly use\nshell quoting, indicating this is an oversight on the exec path."], "mitigation": {"lang": "en:us", "value": "- Avoid using shell metacharacters (>, <, |, ;, &&, $()) in tasks\ntargeting LXC containers via the proxmox_pct_remote connection\nplugin. Use the ansible.builtin.copy or ansible.builtin.template\nmodules instead of raw/shell tasks for file operations.\n- Audit recent Ansible task logs for any tasks run via\nproxmox_pct_remote that contained shell metacharacters \u2014 these\nmay have executed on the Proxmox host instead of the container.\nCheck for unintended file modifications on the host.\n- As a temporary workaround, manually quote commands in tasks:\nansible.builtin.raw: \"pct exec {{ vmid }} -- sh -c '{{ cmd | quote }}'\"\n(This bypasses the connection plugin's command construction.)"}, "name": "CVE-2026-16658", "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-16658\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-16658"], "statement": "while CVSS has a score of 9.9, the impact is rated as IMPORTANT for Red Hat assessment due to deployment-dependent privilege model determining risks. \n1. In most Proxmox deployments, the Ansible SSH user already has\nroot/sudo on the host (to run pct). In that case, the shell\ninjection does not escalate privileges \u2014 it changes WHERE\ncommands execute (host vs container) but the operator already\nhas host access.\n2. In multi-tenant or delegated management models where Ansible\noperators have container access but NOT host access, this IS\na genuine privilege escalation / container escape.\n3. The ACCIDENTAL impact (legitimate tasks with metacharacters\nsilently modifying the host) is the most common real-world\nscenario and is dangerous regardless of privilege model.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "proxmox", "vendor": "proxmox"}], "created": "2026-09-01T13:45:05.283896+00:00", "title": "Container-to-Host Remote Command Injection in Proxmox via Unquoted pct_exec Parameters", "updated": "2026-09-02T22:09:54.455248+00:00", "vendors": ["proxmox", "proxmox$PRODUCT$proxmox"]}