{"schema_version":"1.7.3","id":"GHSA-gwch-7m8v-7544","published":"2026-02-02T20:25:53Z","modified":"2026-02-05T06:56:04.104744Z","aliases":["CVE-2026-25499","GO-2026-4395"],"summary":"terraform-provider-proxmox has insecure sudo recommendation in the documentation","details":"> Note: It is uncertain whether this constitutes a vulnerability or should be filed as an issue instead.\n\n### Summary\n\nIn the SSH configuration documentation, the sudoer line that was suggested can be escalated to edit any files in the system.\n\n### Details\n\nThe following line were suggested for addition in the sudoers file:\n\n```bash\nterraform ALL=(root) NOPASSWD: /usr/bin/tee /var/lib/vz/*\n```\n\nBut this is highly insecure as  the folder can be escaped using `../` and any files can be edited on the system.\n\n### PoC\n\nUsing a `terraform` user with the previously mentioned line in the `/etc/sudoers` file, a `/etc/sudoers.d/sudo` file can be added using this command:\n\n`echo \"ALL=(ALL) NOPASSWD:ALL\" | tee /var/lib/vz/../../../etc/sudoers.d/sudo`\n\nThis grants access to the full root of the node.\n\n### Impact\n\nThis breaches the access limits of the Terraform user.\n\n### Suggested workaround\n\nUse a strict regex on the command to allow only the names that should be pushed by this user.\n\nExample for cloudinit yaml files:\n\n```bash\nterraform ALL=(root) NOPASSWD: /usr/bin/tee /var/lib/vz/snippets/[A-Za-z0-9-]*\\\\.yaml\n```","affected":[{"package":{"name":"github.com/bpg/terraform-provider-proxmox","ecosystem":"Go","purl":"pkg:golang/github.com/bpg/terraform-provider-proxmox"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.93.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-gwch-7m8v-7544/GHSA-gwch-7m8v-7544.json"}}],"references":[{"type":"WEB","url":"https://github.com/bpg/terraform-provider-proxmox/security/advisories/GHSA-gwch-7m8v-7544"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25499"},{"type":"WEB","url":"https://github.com/bpg/terraform-provider-proxmox/commit/bd604c41a31e2a55dd6acc01b0608be3ea49c023"},{"type":"PACKAGE","url":"https://github.com/bpg/terraform-provider-proxmox"}],"database_specific":{"cwe_ids":["CWE-1188","CWE-22"],"github_reviewed":true,"github_reviewed_at":"2026-02-02T20:25:53Z","nvd_published_at":"2026-02-04T21:16:01Z","severity":"HIGH"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}]}