Proxmox VE

Reads GET /api2/json/version.

targets:
  - id: proxmox-main
    product: proxmox
    address: https://proxmox.example.com:8006
    credentials: proxmox-token

Authentication — required

Confirmed live against a real Proxmox VE 9.2.2 host: this endpoint answers 401 without credentials. Proxmox’s own API token shape is a plain Authorization header value — PVEAPIToken=user@realm!tokenid=secret, the whole string as one token — so token-header fits directly, with its default header (Authorization) already correct:

credentials:
  proxmox-token:
    kind: token-header
    value: "PVEAPIToken=enodia@pve!readonly=${PROXMOX_TOKEN_SECRET}"

The alternative username/password ticket flow (POST /access/ticket for a session cookie plus a CSRF token) is deliberately not supported — a heavier session-login shape, and Proxmox’s own documentation recommends the API token for unattended automation anyway.

Recorded fields

• version
• extra.repoid, when present

CVE correlation

Matched against NVD and БДУ ФСТЭК when a cve: block is configured.

This target covers Proxmox VE itself. For CVEs in the host’s installed packages, add a second target for the same host with product: debian over SSH — its os-release is Debian’s. Debian’s linux package is only matched against a running Debian kernel, so Proxmox’s own kernel isn’t mistaken for one, and Proxmox-built packages get no findings (there’s no public feed for them). See CVE correlation.

Lifecycle resolver

endoflife:proxmox-ve.