Missing redaction of cloudinit cipassword in snapshot config endpoint
Affected packages
qemu-server
Details
The VM-related endpoint /snapshot/{snap}/config for querying the configuration of a snapshot, did not mask the cipassword field in the result. When the snapshot configuration or current configuration is queried via /config, the cipassword field is already masked.
This issue was privately reported by Geoffrey McClinsey <[email protected]>.
Fixed in
- qemu-server >= 9.2.11
References
Advisory PSA-2026-00017-1 was about a similar issue for the cloudinit/dump endpoint.
This page is an unofficial copy of the official Proxmox forum post (opens in a new tab). Always check the original before acting.