PSA-2026-00099: Proxmox: Incomplete validation of UPID when handling "stop task" API requests
This Proxmox advisory covers a security issue in Proxmox Backup Server and Proxmox Datacenter Manager.
Key facts
- Fixed in
- librust-proxmox-rest-server-dev 1.1.1-1, proxmox-backup-server 4.2.7-1, proxmox-datacenter-manager 1.1.8
- Advisory id
- PSA-2026-00099
- Source published
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
Description
A forged UPID value could be used to trick the API handling daemons into stopping a task worker that does not belong to the requesting user. This issue was reported privately by Project Loupe.
Packages: proxmox-backup, proxmox-datacenter-manager, proxmox-rest-server.
Affected products named by the advisory: Proxmox Backup Server.
Text from the source record.
Fix and mitigation
Upgrade to a fixed release named by Proxmox:
- librust-proxmox-rest-server-dev 1.1.1-1
- proxmox-backup-server 4.2.7-1
- proxmox-datacenter-manager 1.1.8
Vendor guidance
- Update to the fixed package versions: librust-proxmox-rest-server-dev >= 1.1.1-1, proxmox-backup-server >= 4.2.7-1, proxmox-datacenter-manager >= 1.1.8.
Support dates for the fixed release lines
- Proxmox Backup Server 1: support ended
More Proxmox advisories
PSA-2026-00098Nov 10, 2026Proxmox Datacenter Manager: Incomplete privilege checks for syncing users in externalPSA-2026-00097Nov 10, 2026Proxmox Datacenter Manager: Authenticated SSRF via ACME Directory URLPSA-2026-00096Nov 10, 2026Proxmox Datacenter Manager: token secrets file writable by unprivileged API daemon userPSA-2026-00087Nov 10, 2026Proxmox Backup Server: Missing privilege check in sync-job modificationPSA-2026-00086Nov 10, 2026Proxmox Backup Server: Missing protections against bogus snapshot creationPSA-2026-00062Oct 7, 2026Proxmox Backup Server: Missing privilege checks
Get an email when Proxmox Backup Server (PBS) publishes the next one.
See Proxmox Backup Server (PBS)'s last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor Proxmox Proxmox Backup Server from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
