CVE-2026-16658: 
Ansible vulnerability analysis and mitigation

CVE-2026-16658 is a shell injection vulnerability in the community.proxmox Ansible collection's proxmox_pct_remote connection plugin (plugins/connection/proxmox_pct_remote.py). The flaw allows shell metacharacters in Ansible task commands to be interpreted by the Proxmox host's shell as root, rather than being safely passed to the target LXC container. A deprecated copy of the affected plugin also exists in community.general since version 10.3.0. The CVE was reported on 2026-07-22 and is currently in a reserved/unpublished state; Feedly AI estimates the severity as HIGH (Red Hat Bugzilla).

The root cause is improper neutralization of special elements used in an OS command (CWE-78 — OS Command Injection). The _build_pct_command() method in proxmox_pct_remote.py constructs the pct exec command by joining arguments with spaces (" ".join(cmd)) and passes the resulting string to Paramiko's chan.exec_command(), which executes it through the Proxmox host's shell. Shell metacharacters such as >, <, |, ;, &&, and $() are therefore interpreted by the host shell running as root, rather than being forwarded to the LXC container. The put_file and fetch_file methods in the same plugin correctly use self._shell.quote() to escape inner commands, but the exec path does not apply this quoting; the fix is to apply the same shlex-based quoting to command arguments in _build_pct_command() (Red Hat Bugzilla).

Successful exploitation allows an attacker or misconfigured Ansible playbook to execute arbitrary shell commands on the Proxmox host as root, rather than within the intended LXC container. This can result in full host compromise, including unauthorized file creation or modification, data exfiltration, and potential lateral movement to all LXC containers managed by the host. A real-world incident was reported where an ansible.builtin.raw task silently overwrote the Proxmox host's /etc/resolv.conf, demonstrating unintended root-level writes to the host filesystem (Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported at this time. The vulnerability requires an attacker to control or influence Ansible task arguments passed through the proxmox_pct_remote connection plugin, which typically implies access to the Ansible control node or playbook definitions. The CVE is currently in a reserved state with no EPSS score or CISA KEV catalog entry published. Nessus plugin 342384 has been created to detect this vulnerability (Tenable, Red Hat Bugzilla).

1. Identify target: Confirm the target Ansible environment uses the community.proxmox collection (any version containing proxmox_pct_remote) or community.general >= 10.3.0 with the deprecated copy of the plugin.
2. Craft malicious task: Construct an Ansible task using the proxmox_pct_remote connection plugin with shell metacharacters in the command argument, e.g., ansible.builtin.raw: echo pwned > /etc/cron.d/backdoor.
3. Execute playbook: Run the playbook targeting a Proxmox host via the vulnerable connection plugin. The _build_pct_command() method joins the command string without quoting and passes it to Paramiko's chan.exec_command().
4. Host shell interprets metacharacters: The Proxmox host's shell (running as root) interprets the metacharacters, executing the injected command on the host rather than inside the LXC container.
5. Achieve root-level impact: The attacker's payload executes as root on the Proxmox host, enabling file writes, privilege persistence, or further lateral movement to managed containers (Red Hat Bugzilla).

• File System: Unexpected files created or modified on the Proxmox host (e.g., /etc/resolv.conf, /etc/cron.d/, /tmp/) that correspond to commands intended for LXC containers; timestamps correlating with Ansible playbook execution windows.
• Logs: Proxmox host shell logs (e.g., /var/log/auth.log, /var/log/syslog) showing unexpected command execution originating from the SSH/Paramiko session used by Ansible; audit logs recording root-level file writes not associated with direct administrator activity.
• Process: Unexpected child processes spawned from the Paramiko/SSH session on the Proxmox host (e.g., sh -c, bash, echo, curl, wget) that should have been scoped to an LXC container.
• Network: Outbound connections from the Proxmox host to unexpected external IPs initiated during Ansible playbook runs (Red Hat Bugzilla).

A fixed version of the community.proxmox collection is pending release; the reporter has provided a one-line fix applying self._shell.quote() (or shlex.quote()) to command arguments in _build_pct_command(), consistent with how put_file and fetch_file already handle quoting. Until a patched release is available, administrators should avoid using shell metacharacters (>, <, |, ;, &&, $()) in Ansible tasks executed via the proxmox_pct_remote connection plugin, and should prefer the ansible.builtin.copy module over ansible.builtin.raw for file operations. Users of community.general >= 10.3.0 should also apply the same precautions for the deprecated plugin copy. Monitor the upstream repository at https://github.com/ansible-collections/community.proxmox for patch releases (Red Hat Bugzilla).

The vulnerability was reported by Jake Badoino, who discovered it in a production environment when an Ansible task silently overwrote the Proxmox host's /etc/resolv.conf. Red Hat's Product Security team has tracked it via OSIDB and assigned a high severity/priority rating. No broader media coverage or notable public researcher commentary has been identified at this time (Red Hat Bugzilla).