ProxCenter v1.4.5 Release Notes: Security Compliance Frameworks for Proxmox Fleets

Published June 2026 · Category: News

---

ProxCenter v1.4.5 is now available. This maintenance release brings a major addition for regulated environments, security compliance frameworks with scored assessments and PDF reports, alongside an important OIDC fix and a batch of migration, inventory and DRS improvements.

Highlights

• Security compliance frameworks (Enterprise). A new Frameworks tab in Compliance assesses your connections against NIST 800-53 r5, NIST 800-171 r2, CMMC Level 2 and ISO/IEC 27001:2022. The assessment reuses ProxCenter's existing hardening checks through a check-to-control crosswalk, displays a score donut with a satisfied / partial / failed breakdown per framework, drills down to a per-node result table, and exports a styled PDF report with cover page, per-control table and provenance. If your auditors ask "show me where your Proxmox estate stands against ISO 27001", the answer is now one click.
• OIDC role preserved on login. v1.4.4 introduced a regression where every OIDC user's role was re-derived from IdP groups on each login, demoting anyone without a group match to viewer and potentially locking out manually assigned admins. The re-sync is now authoritative only when a group-to-role mapping is configured and the IdP actually sent a groups array; otherwise the existing assignment is preserved, mirroring the LDAP behavior. If you run OIDC with manually assigned roles, upgrade.
• Open in Proxmox. A button next to the cluster or node name opens the native Proxmox web interface in a new tab, deep-linking cluster member nodes to their own management IP. ProxCenter manages the fleet; when you need the native UI for a node, it is one click away.

Compliance (Enterprise)

• New Frameworks tab assessing NIST 800-53 r5, NIST 800-171 r2, CMMC Level 2 and ISO/IEC 27001:2022 via a check-to-control crosswalk over the existing hardening checks
• Score donut and satisfied / partial / failed breakdown per framework, with a per-node result table
• Styled PDF export per framework (cover, per-control table, provenance and source link)

RBAC and access

• OIDC role re-sync is only authoritative when group mapping is configured and groups are actually sent; manual assignments are otherwise preserved (fixes the v1.4.4 demotion regression)
• OIDC accounts now display an OIDC auth method instead of "Local", and setting a local password is blocked on OIDC and LDAP accounts across every surface (user edit, profile, API), so an SSO account cannot gain a credentials path that bypasses SSO and MFA

Migration

• SDN VNets now appear in the migration target-network selector alongside Linux and OVS bridges, with clear labelling; nodes whose guest networks are VNets no longer show an empty list
• Warm and direct-ESXi migrations preserve the source NIC's MAC address, matching the cold path, so migrated guests keep their network identity instead of booting with a fresh adapter and a stranded IP; the target boots only after the source powers off, avoiding any MAC collision
• Warm migration reliability: stale /dev/nbdN devices are released before attaching, and the delta apply is chunked to stay under the SSH argument-size limit, fixing late failures on large or busy disks
• Migrating a running LXC container now uses restart mode instead of an online flag Proxmox rejects for containers
• The misleading "vSAN datastore detected" log line is gone from the vCenter NFC path

Inventory

• Open in Proxmox button on clusters and nodes, deep-linking to the node's own management IP with sensible fallbacks behind reverse proxies
• The Network view now enumerates host bridges and VLANs per node, so a cluster with no VMs is no longer empty; bridges open a detail panel (type, VLAN, IP/CIDR, ports, vlan-aware, autostart, attached VMs), and SDN VNet ids resolve to their friendly alias
• Inventory tree expand/collapse state is scoped per tenant, so switching tenant no longer inherits the previous tenant's layout
• The VM delete confirmation dialog spells out exactly what will be removed
• The percent chart Y-axis is widened so the "100%" label is no longer clipped

DRS and maintenance

• The Balance Types selection (VM / CT) is now honored end to end: candidates are filtered by guest type for reactive balancing and homogenization, the setting is persisted and validated, and a guest-type gate at execution time prevents a stale recommendation from moving an excluded guest type
• Node maintenance is simpler and safer: entering maintenance triggers native Proxmox node-maintenance (HA guests evacuated and spread by Proxmox), with a clear note that non-HA guests need manual handling; the forced single-target migration and client-side storage scan are gone
• DRS settings cleanup: dead knobs removed (balancing-method and balancing-mode selectors the engine never read), Balance Types guarded at a minimum of one, resource-weight sliders on one row, and status icons across exclusions and balance-types controls

Connections and reliability

• The cluster SSH test now shows the per-node ok / error breakdown on failure, so one unreachable node no longer hides behind a bare "SSH test failed"; each node is tested against its own management IP
• Old completed tasks are no longer resurfaced as new alerts when the event poller's dedup window outlived Proxmox task retention

Security

• Go orchestrator dependencies bumped (golang.org/x/crypto, x/net, x/sys) to clear the SSH, HTML and IDNA advisories
• As with every release, v1.4.5 went through our standard scanning pipeline (Trivy, CodeQL, Gitleaks, gosec) before publication

Breaking changes and upgrade notes

No breaking changes. Upgrading from v1.4.x requires no manual steps. If you run OIDC, note the role re-sync behavior change described above: it restores the expected behavior for manually assigned roles. If you are still on v1.3.x with SQLite, read the v1.4.0 upgrade guide first: v1.4 requires PostgreSQL.

How to upgrade

docker pull ghcr.io/adminsyspro/proxcenter-frontend:v1.4.5
docker pull ghcr.io/adminsyspro/proxcenter-orchestrator:v1.4.5
docker pull ghcr.io/adminsyspro/proxcenter-weasyprint:v1.4.5

Then restart your stack:

cd /opt/proxcenter
docker compose up -d

Full technical changelog is available on GitHub.

What's next

Compliance frameworks are the first step of a broader push on audit-ready operations for regulated environments. Work also continues on the vDC multi-tenant surface for MSPs and on DRS behavior under heavy multi-cluster workloads.

---

Trying ProxCenter for the first time? Start a trial: the only thing we need is your node count. Coming from VMware? Read our comparison with vCenter and our TCO analysis.