Proxmox bug bounty programs
proxmox.com Updated
Proxmox runs two public programs: a Sorona bug bounty paying up to $1,500 and a self-hosted disclosure program with no cash rewards.
- Top reward
- $1,500
- Sorona
- Programs
- 2
- 1 pays cash
- Targets in scope
- 18
- 3 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Proxmox VE
Sorona · Pays the most of the 2 programs: up to $1,500.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Proxmox VE
Sorona · Bug bounty |
– | – | – | $100 (highest) | $1,500 | Partial | – | 24 hours promised | Open |
|
Proxmox
Self-hosted · Disclosure only |
– | – | – | – | No cash | – | – | 24 hours promised | Open |
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100 (highest)
- Safe harbor
- Partial
- First response
- 24 hours promised
-
- First response
- 24 hours promised
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
18 targets across all 2 programs, each listed once with the programs that cover it. 5 excluded.
-
Authentication in full: PAM, LDAP, Active Directory, OpenID Connect, the ticket and CSRF token model, and every two-factor method offered
Products and areas
Covered by Sorona
-
Backup and restore in full, covering vzdump archives and Proxmox Backup Server integration
Products and areas
Covered by Sorona
-
Cluster membership and cluster RPC, including pmxcfs and the corosync configuration Proxmox drives, where one node trusts another
Products and areas
Covered by Sorona
-
LXC container handling, container configuration, and the templates and appliance images Proxmox unpacks
Products and areas
Covered by Sorona
-
QEMU and KVM integration: VM configuration handling and the command lines Proxmox builds from it, including the device model those arguments expose to a guest
Products and areas
Covered by Sorona
-
The firewall implementation and the rules Proxmox generates for hosts, guests and containers
Products and areas
Covered by Sorona
-
The installer, the repository configuration and the package update path
Products and areas
Covered by Sorona
-
The permission system, covering the path-based ACL model, roles, groups and the API token mechanism with its privilege separation flag
Products and areas
Covered by Sorona
-
The published reporting policy asks for security issues by encrypted email to the vendor security address, covering Proxmox VE alongside Proxmox Backup Server and Mail Gateway under one security team. No component of the shipped product is carved out
Products and areas
Covered by Sorona
-
The pveproxy and pvedaemon control plane on port 8006, running with root privilege, and every API endpoint it exposes
Products and areas
Covered by Sorona
-
The storage layer across ZFS, LVM, Ceph, NFS, iSCSI and directory backends, including disk image and backup file handling
Products and areas
Covered by Sorona
-
The web console paths (noVNC, xterm.js and SPICE) that bridge a browser session to a guest console
Products and areas
Covered by Sorona
-
The web interface itself, including any client-side injection reachable from data a lower-privileged user controls
Products and areas
Covered by Sorona
No target matches. Try part of a host name, such as the company name.
Out of scope 5
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Administrator configuration decisions, such as exposing port 8006 directly to the internet or issuing an API token with broad roles
Sorona
-
Escapes from privileged LXC containers, which the container layer beneath Proxmox does not treat as root-safe
Sorona
-
Missing hardening headers or TLS cipher preferences with no demonstrated impact
Sorona
-
QEMU, Linux kernel or Ceph defects upstream of Proxmox, unless Proxmox's own wrapper code or configuration is what makes them reachable
Sorona
-
The vendor's subscription infrastructure and public websites rather than the shipped product
Sorona
Recent changes
Reward and scope changes across every Proxmox program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Proxmox products, from the NVD.
-
CVE-2026-51080 Critical
libpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7 were discovered to contain an XML External Entity (XXE) vulnerability.
-
CVE-2026-51080 Critical
libpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7 were discovered to contain an XML External Entity (XXE) vulnerability.
-
CVE-2025-57540 Medium
A stored cross-site scripting (XSS) vulnerability exists in the WebAuthn Relying Party field within the Datacenter configuration of Proxmox Virtual Environment (PVE) 8.4. Authenticated users can inject JavaScript code that is later executed in the browsers of users who view the configuration page, enabling client-side attacks.
-
CVE-2025-57539 Medium
A stored cross-site scripting (XSS) vulnerability in the U2F Origin field of the Datacenter configuration in Proxmox Virtual Environment (PVE) 8.4 allows authenticated users to store malicious input. The payload is rendered unsafely in the Web UI and executed when viewed by other users, potentially leading to session hijacking or other attacks.
-
CVE-2025-57539 Medium
A stored cross-site scripting (XSS) vulnerability in the U2F Origin field of the Datacenter configuration in Proxmox Virtual Environment (PVE) 8.4 allows authenticated users to store malicious input. The payload is rendered unsafely in the Web UI and executed when viewed by other users, potentially leading to session hijacking or other attacks.
-
CVE-2025-57540 Medium
A stored cross-site scripting (XSS) vulnerability exists in the WebAuthn Relying Party field within the Datacenter configuration of Proxmox Virtual Environment (PVE) 8.4. Authenticated users can inject JavaScript code that is later executed in the browsers of users who view the configuration page, enabling client-side attacks.
-
CVE-2025-57538 Medium
A stored cross-site scripting (XSS) vulnerability in the HTTP Proxy field within the Datacenter configuration panel of Proxmox Virtual Environment (PVE) 8.4 allows an authenticated user to inject malicious input. The input is stored and executed in the context of other users' browsers when they view the affected configuration page. This can lead to arbitrary JavaScript execution.
-
CVE-2025-57538 Medium
A stored cross-site scripting (XSS) vulnerability in the HTTP Proxy field within the Datacenter configuration panel of Proxmox Virtual Environment (PVE) 8.4 allows an authenticated user to inject malicious input. The input is stored and executed in the context of other users' browsers when they view the affected configuration page. This can lead to arbitrary JavaScript execution.
About this page
This page gathers every public program listed under proxmox.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.