CVE-2026-94588: Proxmox pmg-api CSRF Vulnerability

CVE-2026-94588 Overview

CVE-2026-94588 is an argument injection vulnerability in Proxmox Mail Gateway's pmg-api component. The flaw resides in the package changelog retrieval functionality, which passes user-supplied input to the underlying apt-get command without proper sanitization. An authenticated attacker can inject additional command-line arguments into the apt-get invocation. The vulnerability is also exploitable through a Cross-Site Request Forgery (CSRF) style attack, allowing an attacker to leverage an authenticated administrator's session. The issue is tracked under CWE-88: Improper Neutralization of Argument Delimiters in a Command.

Critical Impact
Authenticated attackers can inject arguments into apt-get calls through the changelog retrieval endpoint, affecting confidentiality and integrity of Proxmox Mail Gateway systems.

Affected Products

Proxmox Mail Gateway (pmg-api component)
Refer to the Proxmox Mail Gateway Security Advisory for specific affected versions

Discovery Timeline

2026-09-21 - CVE-2026-94588 published to the National Vulnerability Database (NVD)
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-94588

Vulnerability Analysis

The vulnerability originates in the pmg-api endpoint that retrieves package changelogs. The API takes a package name from user input and passes it to apt-get changelog for processing. Because the input is not filtered for argument delimiters, an attacker can supply values that apt-get interprets as additional flags rather than a package identifier.

Argument injection differs from classic command injection. The attacker does not spawn a new shell process. Instead, the attacker manipulates how the existing binary parses its own arguments, enabling behaviors such as writing to attacker-chosen files or altering configuration paths supported by apt-get.

Exploitation requires an authenticated session with sufficient privileges. However, the vulnerability can be triggered through CSRF, meaning an attacker only needs a privileged user to visit a malicious page while logged in to the pmg-api interface. This lowers the practical barrier to exploitation in administrative environments.

Root Cause

The root cause is improper handling of user-supplied input passed to apt-get. The pmg-api does not validate that the package name begins with a non-hyphen character, nor does it use the -- end-of-options separator to prevent flag parsing. This is a textbook [CWE-88] pattern where argument delimiters remain interpretable by the downstream binary.

Attack Vector

The attack vector is network-based. An attacker with valid credentials sends a crafted HTTP request to the changelog retrieval endpoint. Alternatively, an attacker hosts a malicious page that submits the same request from an authenticated administrator's browser through CSRF. Full technical details are available in the Proxmox Mail Gateway Security Advisory.

Detection Methods for CVE-2026-94588

Indicators of Compromise

Unexpected apt-get process invocations spawned by the pmg-api service with unusual command-line flags
HTTP requests to the changelog API endpoint containing hyphen-prefixed values in the package name parameter
Modifications to files or configuration paths that correlate with apt-get option flags such as -o or -c

Detection Strategies

Audit web server and pmg-api access logs for changelog endpoint requests containing suspicious argument patterns
Monitor process execution telemetry for apt-get changelog invocations with arguments beginning with a dash
Correlate authenticated session activity with outbound requests originating from administrator browsers to detect CSRF exploitation attempts

Monitoring Recommendations

Enable verbose logging on the pmg-api service to capture full request parameters passed to package management functions
Establish a baseline for expected apt-get command-line arguments and alert on deviations
Track authentication events for administrative accounts and correlate with changelog API calls

How to Mitigate CVE-2026-94588

Immediate Actions Required

Apply the vendor-supplied patch referenced in the Proxmox Mail Gateway Security Advisory as soon as it is available
Restrict administrative access to the pmg-api interface to trusted networks and hardened workstations
Enforce CSRF protections and require re-authentication for sensitive package management operations

Patch Information

Proxmox has published fix information in the Proxmox Mail Gateway security advisory thread. Administrators should update pmg-api to the patched version listed in the vendor advisory and restart affected services.

Workarounds

Limit access to the pmg-api web interface using firewall rules or reverse proxy access control lists
Require administrators to use dedicated browser profiles or sessions when managing Proxmox Mail Gateway to reduce CSRF exposure
Temporarily disable the changelog retrieval feature at the reverse proxy layer if patching cannot be performed immediately

bash

# Example: restrict pmg-api access at the firewall to a management subnet
iptables -A INPUT -p tcp --dport 8006 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8006 -j DROP