CVE-2026-94588
Medium
Description
In Proxmox pmg-api, an argument injection vulnerability exists in the package changelog retrieval functionality. This is caused by improper handling of user-supplied input passed to the underlying apt-get command when fetching package changelogs. It requires authentication but can be exploited in a CSRF-style attack.
SeverityMedium
CVSS4.4
Exploit probability—
ProductProxmox Pmg-api
PublishedSep 21, 2026
First seenSep 21, 2026
Weakness typeCWE-88CWE-88
How to fix
Update
- Proxmox pmg-api9.0.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Proxmox pmg-api | 9.0.0 ≤ v < 9.0.3 | 9.0.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.