High SEVERITY — Vulnerability

runc CVE-2024-21626: LXC container escape patch

A runtime container vulnerability can allow access to the host filesystem; the patched version in the PVE repositories should be installed.

Platform
Proxmox VE
Version
PVE 8 / Bookworm tabanlı
CVE Record
CVE-2024-21626
CVSS Score
8.6/10
Published
01 February 2026
Views
33
Primary source: Review the official advisory at forum.proxmox.com Go to Source

Summary

CVE-2024-21626, runc's WORKDIR handling bug allows escaping from a container to the host filesystem. The direct impact on PVE is limited because the LXC infrastructure in PVE does not use runc; however, the risk is high for VMs and CTs running nested Docker/Podman.

Action

  • Use apt dist-upgrade to install up-to-date kernel and userland packages
  • Update CT templates that run Docker
  • If possible, move containers to unprivileged mode

Proxmox VE — Related Advisories

VIEW ALL →
Proxmox VE 01 Sep 2026
Critical · 9.3

CVE-2023-54391 — Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-contro

Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value in the API login endpoint. Attackers can send a POST request to the access ticket API endpoint with any value in the tfa-challenge parameter to completely skip password verification

CVE-2023-54391 Vulnerability 43