A security + maintenance release on top of 1.0.1.
🔒 Security
- Console / per-VM access control (CVE) — a Client-Portal user scoped to specific VMs via a VM-ACL could reach any VM on a cluster their tenant owns (console + all per-VM operations). The per-VM check now enforces the ACL / pool scope even on tenant-owned clusters. Reported by Jörg Morasch (SYMPLASSON Informationstechnik GmbH).
- Broad authorization audit — the same object-level (BOLA / CWE-639) gap is closed across bulk + cross-cluster migrate, PBS restore / protect / notes / prune, migration history and the HA plugin; and tenant-delegate privilege-escalation paths are closed (a delegate can no longer grant permissions it does not hold, reset a higher-privileged same-tenant peer's password / 2FA, or keep console/shell access after being disabled).
- SSRF DNS-rebinding (GHSA-hmcf-9q7f-vx35) — the shared outbound-URL guard validated the host but did not pin it, so a low-TTL rebinding domain could pass the check and connect to an internal address. The validated IP is now pinned for outbound requests. Reported by @senti-man.
🔑 Auth
- OIDC no longer races itself to a logout mid-callback in Firefox (#681).
- OIDC group → role mappings apply custom roles (#682).
🐛 Fixes
- Adding a 2FA cluster — a Proxmox account with two-factor auth now shows a clear, localized message (add with an API token, or temporarily disable 2FA) instead of a silent "connected then offline". Localized in all 8 UI languages (#683).
- SMART health now shows for HDDs without a wearout value (#690).
- Snapshot overview gained multi-select checkboxes + bulk delete (#696).
- EFI / TPM disks accept a
raw/qcow2format, like Proxmox (#678). - The VM/CT config modal no longer reload-loops (#698); the backup-verification modal no longer overlaps the PBS UI (#701).
✨ Features
- Rolling updates reboot a node only when
needrestart -preports a required restart (#694). PR by @gyptazy. - Internal / private ACME CA is supported opt-in (#685).
- Cloudflare DNS-01 is a first-class Let's Encrypt provider (#687). Thanks @brngates98.
- Hardware-health rollups are based on live sensor / SEL state and name the contributor (#686).
- The prebuilt VM / LXC appliances ship
sshpass, so password-auth SSH works out of the box (#688). - Self-update is install-method aware (apt / docker / source).
✅ Quality
555 automated tests (authorization, integration, SSRF, SSL-bootstrap, hardware, i18n) run on every PR. The whole branch was re-audited and end-to-end verified before release.
Thank you to everyone who filed, fixed, translated and sponsored along the way. 💚
💛 Sponsors
PegaProx is AGPL-3.0 and built in the open. Huge thanks to our Platinum sponsors who keep it moving:
💎 Platinum