Proxmox VE Security Review
A Proxmox VE cluster is only as locked down as the realms, roles and tokens someone actually configured on it. We test what was assigned, not what the interface shows by default. CREST-certified testers, fixed price from £3,470 for a 3-day single-estate scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
Proxmox VE authenticates against five realm types, Linux PAM, its own Proxmox VE authentication server, LDAP, Microsoft Active Directory and OpenID Connect, and each one can independently be set to require two-factor authentication or act as the default login realm.
A Proxmox VE cluster is only as secure as the realms, roles and tokens your team configured on top of it
Proxmox VE supports five authentication realms, Linux PAM, its own Proxmox VE authentication server, LDAP, Microsoft Active Directory and OpenID Connect, reached through a web interface that runs on port 8006 by default. The root user can always log in through the Linux PAM realm as an unconfined administrator and cannot be deleted, and two-factor authentication is only enforced when a realm is explicitly configured to require it or a user has chosen to opt in, never by default on any realm. Which realm your team actually put in front of the cluster, how many accounts still authenticate as root@pam, and whether two-factor authentication genuinely covers every account that can reach it is a decision your organisation made, not a Proxmox default.
Proxmox VE uses a role and path based permission system, assigning one of seventeen predefined roles, from PVEAuditor’s read-only access to PVEAdmin’s near-full control, to a user, group or API token against an object path such as /vms, /storage/{storeid} or /pool/{poolname}, with permissions propagating down that path unless a NoAccess entry cancels them. An API token can be issued with Separated Privileges, needing its own explicit ACL entries on top of the user’s access and unable to exceed it, or with Full Privileges matching the user exactly, and a privilege-separated token can never reach further than the user it belongs to even if that user’s role is later widened. Which roles sit against which paths, and how many tokens still carry Full Privileges instead of a scoped set of ACLs, is exactly what a permission review has to establish.
We test the cluster your team actually built: the realms, roles, ACL paths and API tokens configured, the bridges, VLANs and SDN zones carrying guest traffic, the cluster-wide and host firewall rules, and the access controls and encryption protecting backups on Proxmox Backup Server. We never test Proxmox’s own hypervisor, QEMU, LXC or Corosync code, only the configuration your organisation is responsible for.
SCOPE
What we review in a Proxmox VE cluster
Management Access, Realms and root@pam
Proxmox VE authenticates through Linux PAM, its own Proxmox VE authentication server, LDAP, Microsoft Active Directory or OpenID Connect, reached over a web interface that runs on port 8006 by default, and the root user can always log in through the Linux PAM realm as an unconfined administrator that cannot be deleted. We test which realm is actually set as the default for login, how many accounts still authenticate as root@pam day to day, and whether the web interface is reachable from further than it needs to be.
Two-Factor Authentication Coverage
Two-factor authentication in Proxmox VE is either enforced by a realm through TOTP or YubiKey OTP, or opted into by an individual user through TOTP, WebAuthn or single-use recovery keys, and it is never required by default on any realm. We test whether two-factor authentication is genuinely enforced for every account that can reach the web interface, or whether it is left as an option nobody has turned on.
Users, Groups and the Predefined Roles
User attributes live in a cluster-wide user.cfg, identified as
Permission Paths: /vms, /storage and Resource Pools
Permissions are applied to object paths such as /vms, /vms/{vmid}, /storage/{storeid} and /pool/{poolname}, forming a tree where access granted higher up propagates down unless a NoAccess entry cancels it, and resource pools let a single permission cover a whole set of VMs and storage at once. We test what each path actually grants against what the role assigned to it should allow, and whether propagation has quietly extended access further down the tree than intended.
API Tokens and Privilege Separation
An API token can be issued with Separated Privileges, the default, which needs its own explicit ACL entries and can never reach further than the user it belongs to, or with Full Privileges, matching the associated user exactly, and the token’s secret value is only ever displayed once at creation. We test which tokens still carry Full Privileges rather than a scoped set of ACLs, whether any token has outlived the automation it was issued for, and how a compromised token’s reach compares to the account it was cut from.
VM and Host Boundaries
VM-level privileges such as VM.Config.Disk, VM.Config.Network, VM.Console and VM.Migrate are granted separately from node-level privileges like Sys.Modify and Sys.Console, so a role built for managing guests does not automatically carry host administration rights. We test whether an account with VM-only privileges can still reach node configuration, storage allocation or another guest through a path that was never meant to propagate that far.
Virtual Networking: Bridges, VLANs and SDN Zones
The default network setup gives every node a single Linux bridge that all VMs can share, with up to 4094 bridges per host and VLANs configured by appending a tag to the interface name, while Software-Defined Network zones (Simple, VLAN, QinQ, VXLAN or EVPN) are restricted to specific nodes and carry their own permissions. We test whether guest traffic is actually separated onto the VLANs and zones your configuration describes, or whether workloads from different trust levels still share the same bridge.
Cluster-Wide and Host Firewall Rules
The Proxmox VE firewall is completely disabled by default, applies separately at cluster-wide, host and VM level with host-level rules taking precedence, and forwarded traffic between zones is only enforced by the newer nftables-based firewall rather than the standard service. We test whether the firewall is actually enabled where you believe it is, whether host-level rules have quietly overridden a cluster-wide policy, and what a VM’s own rule set permits beyond what its workload needs.
Backups: Proxmox Backup Server Access and Encryption
Proxmox Backup Server runs its own realms and role and path permission system separate from Proxmox VE, and a backup is only encrypted if a client-side AES-256-GCM key was explicitly created, since a key is not generated for you and an optional master key can be used to escrow and recover it. We test who can actually reach your Backup Server datastores, whether the accounts with restore rights match who should hold them, and whether backup encryption is genuinely in place rather than assumed.
Cluster Communication and Shared Configuration Trust
Cluster nodes communicate over the Corosync protocol on UDP ports 5405 to 5412 and share a single replicated configuration filesystem covering users, ACLs, firewall rules and SDN settings, so joining a node to the cluster extends that trust to everything stored there. We test what a newly joined or compromised node can actually reach through that shared configuration, and whether cluster membership has been extended further than it should.
OUR PROCESS
Proxmox VE Security Review: From Scope to Attestation
Scope and Access
We agree which Proxmox VE nodes, storage, SDN zones and Proxmox Backup Server datastores are in scope, plus at least one login for each realm and role you use.
Configuration and Role Mapping
We map every realm, role, ACL path and API token against what it actually grants, alongside your current firewall, networking and backup configuration.
Manual Testing
A CREST-certified tester manually tests permission paths, API token scope, firewall rules and Backup Server access, chaining findings where they compound.
Attestation and Retest
You get a technical report with CVSS scores and reproduction steps, a walkthrough call, a free retest once fixes are deployed, and an attestation letter for auditors.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST Proxmox VE pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent Proxmox VE Security Review Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
3 to 4 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote4 to 6 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote6 to 8 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test Proxmox VE For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From Proxmox VE Security Review
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our Proxmox VE cluster?
We need at least one login for each realm and role your team actually uses, ideally a PVEAdmin or PVEAuditor level account across the realms in scope, plus read access to your current user.cfg, ACLs, firewall rules and SDN configuration. An API token scoped to the same access speeds up several checks but is not required to start.
Will testing touch our live VMs and their data?
Testing focuses on the realms, roles, ACL paths, API tokens, networking and backup configuration around your cluster, rather than the data inside your VMs. Where proving a finding needs a test VM, a snapshot restore or a sample backup job, we agree the exact scope with you first and remove anything we create once testing is complete.
Is Proxmox VE self-hosted, and does that change the scope?
Yes. Proxmox VE and Proxmox Backup Server run on infrastructure your organisation owns and operates, whether that is your own datacentre or a rented rack, so the review covers the configuration you control rather than a vendor-hosted platform. If your nodes sit inside a hosting provider’s network, the physical layer below your control stays out of scope.
How long does a Proxmox VE security review take?
A single cluster with a typical number of nodes, VMs and one Proxmox Backup Server datastore sits in our 3-day single-estate scope, with a report usually landing around 6 to 8 working days after kickoff. A larger cluster with SDN, Ceph storage or multiple Backup Server datastores extends that scope.
What is out of scope for a single-estate review?
Testing Proxmox’s own hypervisor, QEMU, LXC or Corosync code is never in scope, and we do not run denial-of-service testing against a production cluster. The operating system and application running inside a guest VM or container is scoped and quoted separately from the cluster and access review.
Does Proxmox have a customer penetration-testing policy we need to follow?
Proxmox VE and Proxmox Backup Server are software you install and run on your own infrastructure, so there is no shared vendor platform with a published customer testing or notification policy in the way a SaaS provider has. We confirm your current subscription and support agreement terms during scoping before testing begins.
Do you need root or Administrator access to test?
No. We test with the realm accounts and roles you provide across the range your team actually uses, and we do not need standing root@pam or Administrator access beyond what is needed to verify a specific finding during the engagement. Source code for anything running inside a guest is only needed if you commission that application as a separate assessment.
Are your testers CREST certified?
Yes. Every Proxmox VE engagement is carried out by UK-based, CREST-certified testers, and your report and attestation letter are recognised by auditors and insurers accordingly.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your Proxmox VE cluster
A Proxmox VE cluster is only as locked down as the realms, roles and tokens someone actually configured on it. We test what was assigned, not what the interface shows by default. CREST-certified testers, fixed price from £3,470 for a 3-day single-estate scope, quoted within 24 hours.
