Proxmox CVE

Guest overwrite due to incorrect application of pool ACLs

PSA-2026-00084-1 PVE

Affected packages

qemu-server, pve-container

Details

An attacker with VM.Allocate on a pool could overwrite arbitrary existing guests via the restore API.

This issue was found internally.

Fixed in

  • qemu-server >= 9.2.13
  • pve-container >= 6.1.15

This page is an unofficial copy of the official Proxmox forum post (opens in a new tab). Always check the original before acting.