PSA-2026-00086: Proxmox Backup Server: Missing protections against bogus snapshot creation
This Proxmox advisory covers a security issue in Proxmox Backup Server.
Key facts
- Fixed in
- proxmox-backup-server 4.2.9-1
- Advisory id
- PSA-2026-00086
- Source published
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
Description
An attacker that only has "Datastore. Backup" privileges on a datastore could create bogus snapshots in a group they own.
Independently executed prune tasks (such as by a scheduled job or administrator with higher privileges) would treat such bogus snapshots as legitimate.
These two issues combined could be exploited to trigger a pruning of all legitimate snapshots in such an accessible group, thwarting the ransomware protection guards usually associated with only giving "Datastore. Backup" privileges to a user/token.
Creating such bogus snapshots is now restricted. These issues were discovered internally, and independently reported by Richard DEMONGEOT - Rdem Systems.
Packages: proxmox-backup-server.
Text from the source record.
Fix and mitigation
Upgrade to a fixed release named by Proxmox:
- proxmox-backup-server 4.2.9-1
Vendor guidance
- Update to the fixed package versions: proxmox-backup-server >= 4.2.9-1.
End-of-life dates for Proxmox Backup Server
More Proxmox advisories
PSA-2026-00099Nov 10, 2026Proxmox: Incomplete validation of UPID when handling "stop task" API requestsPSA-2026-00087Nov 10, 2026Proxmox Backup Server: Missing privilege check in sync-job modificationPSA-2026-00062Oct 7, 2026Proxmox Backup Server: Missing privilege checksPSA-2026-00061Oct 7, 2026Proxmox Backup Server: Missing validation of chunk sizes during pull syncPSA-2026-00060Oct 7, 2026Proxmox Backup Server: Missing privilege checks when removing namespace from prune jobPSA-2026-00059Oct 7, 2026Proxmox Backup Server: pxar/container restore target rootfs escape
Get an email when Proxmox Backup Server (PBS) publishes the next one.
See Proxmox Backup Server (PBS)'s last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor Proxmox Proxmox Backup Server from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
