Proxmox CVE

Log poisoning via crafted HTTP Forwarded header

PSA-2026-00009-1 PBS

Affected packages

proxmox-backup-server

Details

Clients could inject arbitrary IP addresses into Proxmox Backup Server authentication logs by adding Forwarded HTTP headers to their requests.

Systems behinded a reverse-proxy that require the client's IP address to be included in logs can revert to the previous behaviour by setting the PROXY_REAL_IP_HEADER and PROXY_REAL_IP_ALLOW_FROM environment variables for the proxmox-backup-proxy systemd unit according to their proxy configuration.

Fixed in

  • proxmox-backup-server 4.1.4-1 (PBS 4.x)
  • proxmox-backup-server 3.4.8-3 (PBS 3.x)

This page is an unofficial copy of the official Proxmox forum post (opens in a new tab). Always check the original before acting.