Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Proxmox VE

By Proxmox Bug bounty on Sorona proxmox.com

Accepting reports open-source
Go to program Website
Top reward
$1,500
Top severity paid
Critical
Assets in scope
14
Public CVEs
13
Last change
No changes yet

At a glance

What to know before you start testing.

Pays from $1,500
for critical bugs.
Report on Sorona
Submit through the program page.
Partial safe harbor
Some legal protection; read the terms.
Replies within 1 day
As the policy promises.
Publish after a fix
Coordinate the timing with the company.

Rewards

What Sorona lists as the payout for each severity.

Severity Reward
Critical $1,500+
High $700+
Medium $300+
Low $100 $100 / 1 month Claude Max
Response
Within 1 days Initial confirmation is targeted at one Austrian business day
Safe harbor
Partial Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.

Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

14 assets you may test, 5 excluded.

Web 1

  • https://www.proxmox.com

Products and areas 13

  • Authentication in full: PAM, LDAP, Active Directory, OpenID Connect, the ticket and CSRF token model, and every two-factor method offered
  • Backup and restore in full, covering vzdump archives and Proxmox Backup Server integration
  • Cluster membership and cluster RPC, including pmxcfs and the corosync configuration Proxmox drives, where one node trusts another
  • LXC container handling, container configuration, and the templates and appliance images Proxmox unpacks
  • QEMU and KVM integration: VM configuration handling and the command lines Proxmox builds from it, including the device model those arguments expose to a guest
  • The firewall implementation and the rules Proxmox generates for hosts, guests and containers
  • The installer, the repository configuration and the package update path
  • The permission system, covering the path-based ACL model, roles, groups and the API token mechanism with its privilege separation flag
  • The published reporting policy asks for security issues by encrypted email to the vendor security address, covering Proxmox VE alongside Proxmox Backup Server and Mail Gateway under one security team. No component of the shipped product is carved out
  • The pveproxy and pvedaemon control plane on port 8006, running with root privilege, and every API endpoint it exposes
  • The storage layer across ZFS, LVM, Ceph, NFS, iSCSI and directory backends, including disk image and backup file handling
  • The web console paths (noVNC, xterm.js and SPICE) that bridge a browser session to a guest console
  • The web interface itself, including any client-side injection reachable from data a lower-privileged user controls
Out of scope (5)
  • Administrator configuration decisions, such as exposing port 8006 directly to the internet or issuing an API token with broad roles
  • Escapes from privileged LXC containers, which the container layer beneath Proxmox does not treat as root-safe
  • Missing hardening headers or TLS cipher preferences with no demonstrated impact
  • QEMU, Linux kernel or Ceph defects upstream of Proxmox, unless Proxmox's own wrapper code or configuration is what makes them reachable
  • The vendor's subscription infrastructure and public websites rather than the shipped product

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.

While testing

  • Submit through sorona.xyz.
  • Report privately to the address on the policy page , the address published in the vendor's signed /.well-known/security.txt
  • Encrypt to the 4096-bit PGP key the policy specifies, fingerprint E679 2AA6 98E1 1855 375A B9E3 5D0C BD43 61F2 04C5
  • The policy welcomes working exploit code and states it will not be published, so send the exploit rather than a description of one
  • State the authenticated role and realm you started from.
  • Give the exact package versions from pveversion -v.

Not accepted

  • QEMU, Linux kernel or Ceph defects upstream of Proxmox, unless Proxmox's own wrapper code or configuration is what makes them reachable
  • Escapes from privileged LXC containers
  • Administrator configuration decisions, such as exposing port 8006 directly to the internet or issuing an API token with broad roles
  • Missing hardening headers or TLS cipher preferences with no demonstrated impact
  • The vendor's subscription infrastructure and public websites rather than the shipped product

Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 9 minutes ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD
CVESeverityPublished
CVE-2026-51080 Critical 9.8 17 Jul 2026
CVE-2025-57539 Medium 5.4 9 Sep 2025
CVE-2025-57540 Medium 5.4 9 Sep 2025
CVE-2025-57538 Medium 5.4 9 Sep 2025
CVE-2023-46854 Medium 5.4 28 Oct 2023
CVE-2023-43320 High 8.8 27 Sep 2023
CVE-2022-31358 Critical 9.0 14 Dec 2022
CVE-2022-35507 High 7.1 4 Dec 2022
CVE-2022-35508 Critical 9.8 4 Dec 2022
CVE-2014-4156 Medium 5.3 27 Jan 2020
CVE-2015-9057 Medium 6.1 3 May 2017
CVE-2015-9058 Medium 6.1 3 May 2017
CVE-2014-2325 Medium 4.3 14 Mar 2014

Original policy

Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 6 Last 12 months 12 Lifetime Authorization bypass 35 % Privilege escalation 25 % Command injection 20 % Guest/container escape 20 % Latest advisories Loading the feed Overview Proxmox VE is a turnkey KVM and LXC platform on Debian, and it has become the default open-source hypervisor for small business, managed service providers and homelabs, with a large European public-sector footprint and most of the traffic leaving VMware after the Broadcom acquisition. One host carries a root-privileged web control plane on port 8006 alongside the QEMU device model, LXC containers, Ceph and cluster RPC. A control-plane authorisation bug is fleet-wide compromise; a QEMU or LXC bug is a tenant escape. The vendor runs a professional intake with a signed security.txt and published embargo terms, and pays nothing, so sorona.xyz pays you directly on qualified, reproduced findings. In scope The published reporting policy asks for security issues by encrypted email to the vendor security address, covering Proxmox VE alongside Proxmox Backup Server and Mail Gateway under one security team. No component of the shipped product is carved out The pveproxy and pvedaemon control plane on port 8006, running with root privilege, and every API endpoint it exposes Authentication in full: PAM, LDAP, Active Directory, OpenID Connect, the ticket and CSRF token model, and every two-factor method offered The permission system, covering the path-based ACL model, roles, groups and the API token mechanism with its privilege separation flag QEMU and KVM integration: VM configuration handling and the command lines Proxmox builds from it, including the device model those arguments expose to a guest LXC container handling, container configuration, and the templates and appliance images Proxmox unpacks The storage layer across ZFS, LVM, Ceph, NFS, iSCSI and directory backends, including disk image and backup file handling Backup and restore in full, covering vzdump archives and Proxmox Backup Server integration Cluster membership and cluster RPC, including pmxcfs and the corosync configuration Proxmox drives, where one node trusts another The web console paths (noVNC, xterm.js and SPICE) that bridge a browser session to a guest console The firewall implementation and the rules Proxmox generates for hosts, guests and containers The installer, the repository configuration and the package update path The web interface itself, including any client-side injection reachable from data a lower-privileged user controls Out of scope QEMU, Linux kernel or Ceph defects upstream of Proxmox, unless Proxmox's own wrapper code or configuration is what makes them reachable Escapes from privileged LXC containers, which the container layer beneath Proxmox does not treat as root-safe Administrator configuration decisions, such as exposing port 8006 directly to the internet or issuing an API token with broad roles Missing hardening headers or TLS cipher preferences with no demonstrated impact The vendor's subscription infrastructure and public websites rather than the shipped product Most-valued findings Unauthenticated or under-authenticated access to any API path on port 8006. The control plane runs as root and drives every guest in the cluster, so a single missing check there is the whole estate Privilege escalation across the ACL model, particularly a limited role reaching VM or container configuration fields that become hypervisor arguments Anything that turns a guest or container configuration value into command execution on the host Cross-node trust in the cluster RPC path, where compromising one member yields every member Backup and restore handling, especially archive extraction that writes outside its intended directory during a restore Console proxying defects that let one user reach another guest's console session or reuse a console ticket Escape from an unprivileged LXC container, the boundary the stack does treat as real Stored injection in the web interface reachable from a field a low-privileged user controls, since the administrator viewing it holds root on the cluster Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report privately to [email protected] , the address published in the vendor's signed /.well-known/security.txt Encrypt to the 4096-bit PGP key the policy specifies, fingerprint E679 2AA6 98E1 1855 375A B9E3 5D0C BD43 61F2 04C5 The policy welcomes working exploit code and states it will not be published, so send the exploit rather than a description of one Initial confirmation is targeted at one Austrian business day, so factor local holidays into your timing expectations Proxmox Backup Server and Mail Gateway sit with the same security team and the same address. Say which product you hit State the authenticated role and realm you started from. On this product the difference between an unauthenticated path, a PVEVMUser and a root@pam session is most of the severity Give the exact package versions from pveversion -v. Proxmox ships enterprise and no-subscription repositories at different points in the cycle Disclosure Coordinated by the Proxmox security team by encrypted email against a documented embargo process, with an initial confirmation target of one Austrian business day. Fixes ship through the enterprise and no-subscription repositories and are described in the vendor's own advisories and release notes. The policy commits to keeping submitted exploit code private, so agree the publication date before releasing anything of your own. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability