CVE-2026-16658

[CVE catalog]

Severity

Critical · CVSS 9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Published

Aug 22, 2026, 12:00:00 AM UTC

Source

[NVD] · [CVE record]

A flaw was found in the community.proxmox Ansible collection's proxmox_pct_remote connection plugin. The _build_pct_command() method constructs a pct exec command string using unquoted string concatenation and passes it to the Proxmox host's shell via Paramiko. Shell metacharacters in the command (such as >, |, ;, &&, or $()) are interpreted on the host instead of inside the target LXC container, allowing commands intended for an unprivileged container to execute on the hypervisor host as root. This constitutes a container-to-host trust boundary crossing. The put_file and fetch_file methods in the same plugin correctly use shell quoting, indicating this is an oversight on the exec path. while CVSS has a score of 9.9, the impact is rated as IMPORTANT for Red Hat assessment due to deployment-dependent privilege model determining risks. 1. In most Proxmox deployments, the Ansible SSH user already has root/sudo on the host (to run pct). In that case, the shell injection does not escalate privileges — it changes WHERE commands execute (host vs container) but the operator already has host access. 2. In multi-tenant or delegated management models where Ansible operators have container access but NOT host access, this IS a genuine privilege escalation / container escape. 3. The ACCIDENTAL impact (legitimate tasks with metacharacters silently modifying the host) is the most common real-world scenario and is dangerous regardless of privilege model. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.