Proxmox CVE

missing privilege checks for vzdump stop API calls

PSA-2026-00042-1 PVE

Affected packages

pve-manager

Details

Any authenticated user/API token could trigger a stop of running backups.

This issue was reported privately by Geoffrey McClinsey <[email protected]>.

Fixed in

  • pve-manager >= 9.2.8 (PVE 9.x)
  • pve-manager >= 8.4.20 (PVE 8.x)

This page is an unofficial copy of the official Proxmox forum post (opens in a new tab). Always check the original before acting.