WRN potential SSRF attempt blocked - rejected by validator (node_not_cluster_member) - get_temperature failed - rejected by validator

[devachnid]

Describe the bug
Sensor proxy is not working

Nov 12 18:52:53 server pulse-sensor-proxy[565420]: 6:52PM WRN potential SSRF attempt blocked node=192.168.1.200 reason=node_not_cluster_member
Nov 12 18:52:53 server pulse-sensor-proxy[565420]: 6:52PM WRN Node validation failed error="node \"192.168.1.200\" rejected by validator (node_not_cluster_member)" corr_id=2fa857de-2265-43b5-b0d4-4bf5300131de method=get_temperature node=192.168.1.200 pid=3714848 uid=100999
Nov 12 18:52:53 server pulse-sensor-proxy[565420]: {"level":"info","command":"get_temperature","correlation_id":"2fa857de-2265-43b5-b0d4-4bf5300131de","decision":"failed","duration_ms":0,"error":"node \"192.168.1.200\" rejected by validator (node_not_cluster_member)","event_hash":"1c1d95415078de064314fabbefc4ba08770dc5547b93941f022358771f8fe152","event_type":"command.finish","exit_code":1,"peer_gid":100996,"peer_pid":3714848,"peer_uid":100999,"prev_hash":"2aee90988e7f0f5dcd42f928320315455783fa5587d8e9c0d929386640a95c3d","remote_addr":"@","seq":180,"ts":"2025-11-12T18:52:53.048106016Z","time":1762973573}
Nov 12 18:52:53 server pulse-sensor-proxy[565420]: 6:52PM WRN Handler failed error="node \"192.168.1.200\" rejected by validator (node_not_cluster_member)" corr_id=2fa857de-2265-43b5-b0d4-4bf5300131de method=get_temperature pid=3714848 uid=100999

To Reproduce
Steps to reproduce the behavior:

1. Install the pulse-sensor-proxy on the Proxmox host using the command line as advised
2. Check service status - error as per logs and temperature not displayed in Pulse dashboard

Expected behavior
No errors, and temperature reported in Pulse

Environment:

• Pulse Version: v4.29.5
• Installation Type: Proxmox LXC
• 192.168.1.0/24 whitelisted for webhooks

pulse-diagnostics-sanitized-2025-11-12.json

Additional context
Diagnostics attached - shows as proxy socket = Detected and Daemon = running. Clicking "Check proxy nodes" results in "Failed to query proxy nodes" toast notification.

💡 Tip: If you're experiencing connection issues, API errors, or missing data, you can attach diagnostics from Settings → Diagnostics tab → Export for GitHub (sanitized version)

[devachnid]

I created a single node cluster as a test, and it did resolve this error, but it is still not working but with a different validation error:

Nov 14 09:04:13 server pulse-sensor-proxy[2410392]: {"level":"info","command":"get_temperature","correlation_id":"e8b315b3-da1a-473b-930a-2963aad72aff","decision":"allowed","event_hash":"7f5e24b22439fc6e446eb1291430273014e9e5530c5ab9524a7a006e75a38d31","event_type":"command.start","peer_gid":100996,"peer_pid":3714848,"peer_uid":100999,"prev_hash":"5f10c9a63f89ec48ebd12fd875dc37272a50eb7fe8e9b0085845320a7d5055bf","remote_addr":"@","seq":176,"ts":"2025-11-14T09:04:13.751281473Z","time":1763111053}
Nov 14 09:04:14 server pulse-sensor-proxy[2410392]: 9:04AM WRN Cannot access Proxmox cluster IPC - cluster validation disabled. Add nodes to allowed_nodes in config if needed. stderr="ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n"
Nov 14 09:04:14 server pulse-sensor-proxy[2410392]: 9:04AM WRN SECURITY: Cluster validation unavailable - falling back to localhost-only validation. Configure allowed_nodes for cluster-wide access. error="pvecm cluster IPC access denied (check systemd restrictions or run outside container): ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n" node=192.168.1.200
Nov 14 09:04:14 server pulse-sensor-proxy[2410392]: 9:04AM WRN AF_NETLINK restricted by systemd - falling back to 'ip addr' command. Update systemd unit to add AF_NETLINK to RestrictAddressFamilies. error="route ip+net: netlinkrib: address family not supported by protocol"
Nov 14 09:04:14 server pulse-sensor-proxy[2410392]: 9:04AM WRN Failed to run 'ip addr' command error="exit status 1"
Nov 14 09:04:14 server pulse-sensor-proxy[2410392]: 9:04AM WRN potential SSRF attempt blocked node=192.168.1.200 reason=node_not_localhost
Nov 14 09:04:14 server pulse-sensor-proxy[2410392]: 9:04AM WRN Node validation failed error="node \"192.168.1.200\" rejected by validator (node_not_localhost)" corr_id=e8b315b3-da1a-473b-930a-2963aad72aff method=get_temperature node=192.168.1.200 pid=3714848 uid=100999
Nov 14 09:04:14 server pulse-sensor-proxy[2410392]: {"level":"info","command":"get_temperature","correlation_id":"e8b315b3-da1a-473b-930a-2963aad72aff","decision":"failed","duration_ms":545,"error":"node \"192.168.1.200\" rejected by validator (node_not_localhost)","event_hash":"aba8338dfc27de4285c82c36ab8efa39b195896aa2dfe9efb65363427e9dcd09","event_type":"command.finish","exit_code":1,"peer_gid":100996,"peer_pid":3714848,"peer_uid":100999,"prev_hash":"7f5e24b22439fc6e446eb1291430273014e9e5530c5ab9524a7a006e75a38d31","remote_addr":"@","seq":177,"ts":"2025-11-14T09:04:14.29634494Z","time":1763111054}
Nov 14 09:04:14 server pulse-sensor-proxy[2410392]: 9:04AM WRN Handler failed error="node \"192.168.1.200\" rejected by validator (node_not_localhost)" corr_id=e8b315b3-da1a-473b-930a-2963aad72aff method=get_temperature pid=3714848 uid=100999
Nov 14 09:04:14 server pulse-sensor-proxy[2410392]: {"level":"info","correlation_id":"","decision":"allowed","event_hash":"9113bd1f3deaedf6687a53c88045a76dba4698109ac1f100c74ed0854285a6c3","event_type":"connection.accepted","peer_gid":100996,"peer_pid":3714848,"peer_uid":100999,"prev_hash":"aba8338dfc27de4285c82c36ab8efa39b195896aa2dfe9efb65363427e9dcd09","remote_addr":"@","seq":178,"ts":"2025-11-14T09:04:14.704316595Z","time":1763111054}
Nov 14 09:04:14 server pulse-sensor-proxy[2410392]: {"level":"info","command":"get_temperature","correlation_id":"a1cd44b0-c1f0-4827-b75b-219103f78e4f","decision":"allowed","event_hash":"48a2c9eb32001e46fd924f776880dfb23f173dd6b52b59f0634378a650fcd246","event_type":"command.start","peer_gid":100996,"peer_pid":3714848,"peer_uid":100999,"prev_hash":"9113bd1f3deaedf6687a53c88045a76dba4698109ac1f100c74ed0854285a6c3","remote_addr":"@","seq":179,"ts":"2025-11-14T09:04:14.704468392Z","time":1763111054}
Nov 14 09:04:15 server pulse-sensor-proxy[2410392]: 9:04AM WRN Cannot access Proxmox cluster IPC - cluster validation disabled. Add nodes to allowed_nodes in config if needed. stderr="ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n"
Nov 14 09:04:15 server pulse-sensor-proxy[2410392]: 9:04AM WRN SECURITY: Cluster validation unavailable - falling back to localhost-only validation. Configure allowed_nodes for cluster-wide access. error="pvecm cluster IPC access denied (check systemd restrictions or run outside container): ipcc_send_rec[1] failed: Unknown error -1\nipcc_send_rec[2] failed: Unknown error -1\nipcc_send_rec[3] failed: Unknown error -1\nUnable to load access control list: Unknown error -1\n" node=192.168.1.200
Nov 14 09:04:15 server pulse-sensor-proxy[2410392]: 9:04AM WRN AF_NETLINK restricted by systemd - falling back to 'ip addr' command. Update systemd unit to add AF_NETLINK to RestrictAddressFamilies. error="route ip+net: netlinkrib: address family not supported by protocol"
Nov 14 09:04:15 server pulse-sensor-proxy[2410392]: 9:04AM WRN Failed to run 'ip addr' command error="exit status 1"
Nov 14 09:04:15 server pulse-sensor-proxy[2410392]: 9:04AM WRN potential SSRF attempt blocked node=192.168.1.200 reason=node_not_localhost
Nov 14 09:04:15 server pulse-sensor-proxy[2410392]: 9:04AM WRN Node validation failed error="node \"192.168.1.200\" rejected by validator (node_not_localhost)" corr_id=a1cd44b0-c1f0-4827-b75b-219103f78e4f method=get_temperature node=192.168.1.200 pid=3714848 uid=100999
Nov 14 09:04:15 server pulse-sensor-proxy[2410392]: {"level":"info","command":"get_temperature","correlation_id":"a1cd44b0-c1f0-4827-b75b-219103f78e4f","decision":"failed","duration_ms":628,"error":"node \"192.168.1.200\" rejected by validator (node_not_localhost)","event_hash":"b0ed3720d6cb9ff6f2b783c1b691d4276a3e9af83f7c310d38c38b4b475cd3ea","event_type":"command.finish","exit_code":1,"peer_gid":100996,"peer_pid":3714848,"peer_uid":100999,"prev_hash":"48a2c9eb32001e46fd924f776880dfb23f173dd6b52b59f0634378a650fcd246","remote_addr":"@","seq":180,"ts":"2025-11-14T09:04:15.332634845Z","time":1763111055}
Nov 14 09:04:15 server pulse-sensor-proxy[2410392]: 9:04AM WRN Handler failed error="node \"192.168.1.200\" rejected by validator (node_not_localhost)" corr_id=a1cd44b0-c1f0-4827-b75b-219103f78e4f method=get_temperature pid=3714848 uid=100999

[devachnid]

I have updated to v4.31.0 and I am no longer getting any validation errors, and am successfully getting the temperature displayed in the dashboard :-)

[rcourtman]

Noted. v4.31.0 includes 653ce04 so the sensor proxy now resolves cluster hostnames to IPs before evaluating membership, which is what rejected 192.168.1.200 earlier. I will leave this open for a bit longer in case the proxy slips back into localhost-only mode; if the SSRF guard reappears, grab another diagnostics export and I can inspect the IPC restrictions.

[devachnid]

I'm on v4.31.0 and getting a new validation error:

Nov 16 09:24:17 server pulse-sensor-proxy[954874]: 9:24AM WRN SECURITY: peer lacking admin capability attempted privileged method - access denied corr_id=2e808ba8-805e-422a-b893-6654b12518ad gid=100996 method=register_nodes pid=1891489 uid=100999

[devachnid]

Hmm... the error seems to have stopped now, and temps are reported correctly. I'll keep an eye on it