CVE-2026-25499: A Single Sudo Line Opens the Door to Full Root Takeover in Terraform-Proxmox Deployments

CVE-2026-25499

Component: terraform-provider-proxmox
Vulnerability type: Insecure sudo recommendation leading to local privilege escalation
CVSS v3.x score: Not officially assigned
Severity: High
Exploitability: High (local, trivial once conditions are met)
Exploit availability: Publicly known techniques; proof-of-concept exists (educational/research use only)
Attack complexity: Low
Privileges required: Low (terraform user)
User interaction: Not required
Impact: Full root compromise of the Proxmox host

Overview

CVE-2026-25499 describes a security issue caused by an insecure sudo configuration recommended in the documentation of terraform-provider-proxmox. While the provider itself was not intentionally malicious, the documented setup guidance introduced a dangerous privilege escalation path.

Administrators were advised to grant the terraform system user passwordless sudo access to the tee binary for writing files under /var/lib/vz/. This recommendation was meant to simplify file uploads (for example, cloud-init snippets), but it unintentionally allowed attackers to write arbitrary files as root by abusing path traversal (../) sequences.

When combined with the provider’s file upload functionality, this misconfiguration can be exploited to overwrite sensitive system files such as sudoers configuration, resulting in full root access on the Proxmox node.

Affected Environments

The vulnerability affects environments where all of the following conditions are true:

terraform-provider-proxmox is used with SSH-based file uploads.
A local terraform user exists on the Proxmox host.
The sudoers file contains a permissive rule similar to: terraform ALL=(root) NOPASSWD: /usr/bin/tee /var/lib/vz/*
Uploaded file paths or filenames are influenced by Terraform configuration or external input.

If any of these conditions are not present, exploitation is unlikely.

Technical Details

Root Cause

The core issue lies in a combination of two factors:

Overly permissive sudo rule
The sudo configuration allowed the terraform user to execute /usr/bin/tee as root without a password, with a wildcard path restriction.
Lack of strict path enforcement
The tee command does not prevent the use of relative path components such as ../. As a result, paths like: /var/lib/vz/../../../etc/sudoers.d/evil are resolved by the operating system as: /etc/sudoers.d/evil

Because tee was executed as root, the file write was also performed as root.

Exploitation Scenario

From an attacker’s perspective, exploitation follows a straightforward sequence:

Access is gained to Terraform workflows or CI/CD pipelines that apply configurations using the Proxmox provider.
A malicious file upload is triggered using a crafted destination path containing ../.
The upload process invokes sudo tee on the Proxmox host.
A new sudoers file is written under /etc/sudoers.d/.
The attacker grants themselves unrestricted sudo access.
Root access is obtained on the Proxmox node.

Once root access is achieved, complete host compromise is assumed.

Proof of Concept (Educational)

Important: The following is described strictly for defensive understanding and authorized testing. It must never be executed on systems without explicit permission.

A typical demonstration involves writing a new sudoers entry via path traversal:

echo "ALL=(ALL) NOPASSWD:ALL" | sudo /usr/bin/tee /var/lib/vz/../../../etc/sudoers.d/poc

After this operation, the user can execute:

sudo -i

and obtain a root shell.

This confirms that the system is vulnerable if the insecure sudo rule is present.

Impact

Successful exploitation results in:

Full root access on the Proxmox host
Ability to modify system configuration
Persistence through altered sudoers files
Potential compromise of all virtual machines hosted on the node
Loss of integrity and trust in infrastructure automation

Given that Proxmox hosts often manage critical workloads, the real-world impact is considered severe.

Detection and Monitoring

What to Look For

Indicators of potential exploitation include:

Unexpected files appearing in /etc/sudoers.d/
New or modified sudoers entries granting broad privileges
sudo commands executed by the terraform user
File writes outside /var/lib/vz/ initiated by Terraform operations
Root shells spawned shortly after Terraform runs

Relevant Log Sources

To detect abuse, the following log sources should be monitored:

Authentication logs
- /var/log/auth.log or /var/log/secure
Audit logs (auditd)
- File write events targeting /etc/sudoers and /etc/sudoers.d/
System logs / syslog
File Integrity Monitoring (FIM)
- Alerts on changes to sudoers files
CI/CD or Terraform execution logs

Detection Rules

Auditd rule (file monitoring):

-w /etc/sudoers -p wa -k sudoers_changes
-w /etc/sudoers.d/ -p wa -k sudoers_changes

SIEM logic (conceptual):

Alert when:
- user = terraform
- command includes sudo and tee
- destination path contains sudoers
Alert on any new sudoers file creation outside of approved change windows.

MITRE ATT&CK Mapping

Privilege Escalation
- Abuse of sudo misconfiguration
Defense Evasion
- Persistence via sudoers modification
Impact
- Full system compromise

Remediation and Mitigation

Immediate Actions

Remove any sudoers entries that allow unrestricted or wildcard use of tee.
Inspect /etc/sudoers.d/ for unauthorized files.
Assume compromise if malicious sudoers entries are found and perform incident response.

Secure Configuration Guidance

If file uploads must be allowed, permissions should be tightly scoped. A safer sudo rule restricts both path and filename pattern, for example:

terraform ALL=(root) NOPASSWD: /usr/bin/tee /var/lib/vz/snippets/[A-Za-z0-9_-]*.yaml

This prevents directory traversal and limits file types.

Patch / Upgrade Information

The issue has been addressed upstream. Administrators are strongly advised to upgrade to a patched version of the provider.

Official upgrade / patch link:
https://github.com/bpg/terraform-provider-proxmox/releases/tag/v0.93.1

Upgrading removes the insecure guidance and aligns the provider with safer operational practices.

Final Takeaway

This vulnerability highlights how documentation-driven misconfigurations can be just as dangerous as software bugs. No advanced exploitation techniques are required; the weakness is triggered by standard system behavior combined with an unsafe sudo rule.

Environments using infrastructure-as-code should treat sudo permissions as production-critical assets. Any wildcard-based or passwordless sudo rule deserves careful scrutiny.

Timely upgrades, strict privilege boundaries, and continuous monitoring are sufficient to fully mitigate CVE-2026-25499 when applied correctly.