CVE-2026-94588: Proxmox Pmg-API

Medium severity, CVSS 4.4. EPSS: 0.2% chance of exploitation in the next 30 days.

In Proxmox pmg-api, an argument injection vulnerability exists in the package changelog retrieval functionality. This is caused by improper handling of user-supplied input passed to the underlying apt-get command when fetching package changelogs. It requires authentication but can be exploited in a CSRF-style attack.

Affected products

• Proxmox Pmg-API: from 9.0.0, before 9.0.3 (fixed in 9.0.3)

Published 2026-09-21. Last modified 2026-09-24.