CVE-2026-16658
Description
A flaw was found in the community.proxmox Ansible collection's proxmox_pct_remote connection plugin. The _build_pct_command() method constructs a pct exec command string using unquoted string concatenation and passes it to the Proxmox host's shell via Paramiko. Shell metacharacters in the command (such as >, |, ;, &&, or $()) are interpreted on the host instead of inside the target LXC container, allowing commands intended for an unprivileged container to execute on the hypervisor host as root. This constitutes a container-to-host trust boundary crossing. The put_file and fetch_file methods in the same plugin correctly use shell quoting, indicating this is an oversight on the exec path.
Statement
while CVSS has a score of 9.9, the impact is rated as IMPORTANT for Red Hat assessment due to deployment-dependent privilege model determining risks.
In most Proxmox deployments, the Ansible SSH user already has root/sudo on the host (to run pct). In that case, the shell injection does not escalate privileges — it changes WHERE commands execute (host vs container) but the operator already has host access.
In multi-tenant or delegated management models where Ansible operators have container access but NOT host access, this IS a genuine privilege escalation / container escape.
The ACCIDENTAL impact (legitimate tasks with metacharacters silently modifying the host) is the most common real-world scenario and is dangerous regardless of privilege model.
Mitigation
- Avoid using shell metacharacters (>, <, |, ;, &&, $()) in tasks
targeting LXC containers via the proxmox_pct_remote connection
plugin. Use the ansible.builtin.copy or ansible.builtin.template
modules instead of raw/shell tasks for file operations.
- Audit recent Ansible task logs for any tasks run via
proxmox_pct_remote that contained shell metacharacters — these
may have executed on the Proxmox host instead of the container.
Check for unintended file modifications on the host.
- As a temporary workaround, manually quote commands in tasks:
ansible.builtin.raw: "pct exec {{ vmid }} -- sh -c '{{ cmd | quote }}'"
(This bypasses the connection plugin's command construction.)
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Non-Repudiation
Technical Impact: Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart; Read Files or Directories; Modify Files or Directories; Read Application Data; Modify Application Data; Hide Activities
Attackers could execute unauthorized operating system commands, which could then be used to disable the product, or read and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner.
Acknowledgements
Red Hat would like to thank Jake Badoino for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
