Proxmox VE 9.1.19 → 9.2.20
19 releases · 7 breaking changes · 2 security fixes · 0 advisories fixed
2security7breaking4deprecated56feature18fix
Breaking changes
- breaking ask for the checks that prove an OSD is gone before its leftover lockbox key is removed, and no longer suggest removing the authentication entry of a daemon that only seems gone in 9.2.15
- breaking api: ceph: mds: deprecate hotstandby parameter in the API schema, and do not set the mds_standby_for_name and mds_standby_replay config options any more, they were removed in Ceph 14.1 and setting them has no effect any more in 9.2.10
- breaking ui: qemu: default aarch64 VMs to a KVM-usable CPU model instead of one that QEMU rejects at start, and warn when an incompatible ARM CPU model is selected. in 9.2.9
- breaking Remove redundant checks for USB hotplug support and unplug events during unrelated VM configuration changes. in 9.2
- breaking Windows VMs using machine versions 11.0 or 11.0+pve1 are potentially affected by this issue. Such guests may have been created with the packages available in the Proxmox VE 9.2 ISO or qemu-server older than 9.2.0. Upgrading the qemu-server package and setting the machine version to 11.0+pve2 or… in 9.2
- breaking Windows VMs using machine version 11.0+pve2 or newer are not affected by this issue. Under qemu-server 9.2.0 or later, new Windows VMs are created with an unaffected machine version. in 9.2
- breaking Windows VMs using machine versions older than 11.0 are not affected if using qemu-server 9.2.0 or newer. in 9.2
Security changes
- security Fix a boot issue for Windows guests with Virtualization-based Security (VBS) enabled by disabling the cet-ibt and cet-ss CPU flags. in 9.2
- security Prevent local "copy.fail" privilege escalation exploit via AF_ALG sockets within containers by using seccomp filtering (PSA-2026-00018-1). If AF_ALG support is required in a specific container, see the security advisory forum post for more details. in 9.2
Deprecations
- deprecated Switch from the deprecated block-job-complete to the newer job-complete QMP command. in 9.2
- deprecated Deprecate and warn about raw cgroup v1 entries in the container configuration. The support for cgroup v1 will be removed in a future release. in 9.2
- deprecated Switch from the deprecated /etc/timezone to the recommended timedatectl to initialize the containers timezone setting (issue 7175). in 9.2
- deprecated Deprecate the legacy starttime and dow parameters of the backup job API in favor of schedule. The legacy parameters were superseded by schedule since Proxmox VE 7.1 and have now been removed from the API response. in 9.2
Every release in between
9.2.20 Sep 11, 2026
featureRevert "partially fix #1989: ui: qemu: disk: add qcow2 cache size config"
otherthe corresponding qemu-server changes are not yet rolled out
9.2.19 Sep 9, 2026
fixpvesh: fix startup failure caused by API endpoints with empty parameter schemas, such as 'pvesh get /cluster/firewall/options'.
otherceph: Cephx key migration:
featurerefuse staged-key confirmation when a visible client's key cannot be identified, rather than treating a new session as proof of refresh
otherkeep device inspection errors concise without hiding short failure reasons; retain full diagnostics with '--verbose'
featureallow recovery once nodes are reachable, even if daemons with unfinished key updates remain stopped, without assuming their keys need repair
otherseparate unidentified monitor sockets from VM hints to avoid implying that a VM uses a kernel client
otherexplicitly report successful dry-run preflight checks, retaining a warning when '--force' was used
9.2.18 Sep 6, 2026
otherceph: Cephx key migration:
otherprevent client-key retirement or recovery changes before consent
otheravoid unnecessary client reconnects and CephFS remounts caused by monitor elections or older migration records
otherclarify remaining refresh steps and identify affected nodes and mounts
otherceph: auth status:
othershow compact key summaries and next steps for pending keys, service tickets, and kernel compatibility
othermark unavailable data as unknown and distinguish cipher defaults from authentication permissions
9.2.17 Sep 5, 2026
otherceph: Cephx key migration:
featureadd '--rotate-all-storage-keys' to rotate dedicated users of local RBD and CephFS storages together, excluding external clusters and keeping 'client.admin' a separate choice
otherrefuse administrative and storage-user key rotation if any monitor cannot keep both keys valid while consumers refresh
otherkeep both keys valid during rollback until consumers return to the restored key and the operator confirms with '--confirm-abort-clients-refreshed'
otherdetect returning old-key consumers using monitor session fingerprints and recheck consumers before retiring keys or invalidating tickets
otherrefresh CephFS mounts without forced or lazy unmounts; retry busy mounts on a later apply run
otherleave pending daemon keys untouched when their ownership is unclear, and wait for monitor elections to finish before staging
fixcomplete bootstrap and crash key rotations without asking operators to confirm refreshes for Ceph's own tools
featuremake new keys use the new cipher before disabling the old cipher
othershow next steps based on current keys and settings, with concise consumer hints, storage inventories, and recovery instructions
otherceph: auth status: show current and pending key ciphers without exposing secrets, and lead with the next migration command.
9.2.16 Sep 3, 2026
otherceph: Cephx key migration:
featurestage eligible 'client.admin' and storage-user keys while their current keys remain valid, so consumers can refresh before the new key is committed. This requires Ceph 19.2.6-pve3, 20.2.4-pve3, or newer on every monitor; with an older monitor, replace the keys at once as before
otherjournal staged rotations so interrupted work resumes safely; if monitor support disappears, require completion or '--abort-staged-key' instead of falling back to immediate replacement
otherconfirm refreshed consumers per Ceph user or for all ready rotations at once. Refuse confirmation while a recorded consumer is still connected or a monitor did not answer the session query; refuse the all-at-once form entirely if any rotation is not ready
fixadd '--rotate-cluster-keys' as the concise path for the shared 'mon.', bootstrap, crash, and encrypted OSD lockbox keys
otherbefore replacing a Ceph user key at once, tell operators to stop every consumer because its next reconnect can fail immediately
otherprint concise plans by default with affected Ceph users, disruptive steps, warnings, and next commands; provide full inventories with '--verbose'
otheravoid duplicate notices and spurious unfinished records for Ceph user keys rotated by an earlier version of the helper
otherui: ceph: distinguish Cephx migration checks from availability and data health failures, show check-specific next steps, and link to the local documentation
9.2.15 Sep 2, 2026
fixfix #7896: ui: qemu: show the effective implicit machine version for Windows guests and avoid accidentally pinning a fallback when changing other machine settings
otherceph: cephx key migration:
othername the running consumers of every client key a run rotates, and report the recorded consumers that may still hold a replaced key and could fail on a reconnect or ticket expiry
otherconfirm a rotation only for the consumers a run cannot see: the confirmation is refused while a recorded consumer is connected, and an unmeasured rotation is measured first
featureadd --restrict-ciphers to drop the old cipher as a guarded final step, refused while any key depends on it or a recorded consumer may still do so
otherrefuse a rotating-key wipe while a recorded client may still hold a replaced key, and mark the wipe as not recommended, as it invalidates every service ticket and requires all clients and daemons to support aes256k
otheroffer the options that are still open as one command to paste, so the finish of the migration is visible
featureredo the mount of every CephFS storage whose key a run rotates, on each node, so it starts a fresh client with the new key; a mount that is in use is named rather than pulled away, and one that stopped answering is force-unmounted, which frees the processes blocked in it
otherrefuse to rotate a storage key while a pending key is staged for it, as that key would replace the fresh one on its first use and leave the storage copies mismatched
otherfail a run when a node stops answering instead of waiting forever
othersay that the service ticket switch and the cipher restriction make the monitors hold an election, a few seconds in which they do not answer
otherpoint at the independent monitor identity when the admin keyring no longer matches the cluster, instead of a bare permission error
otherignore data directories left by removed or destroyed OSDs while continuing to block existing OSDs without an authentication entry
otheridentify a stopped OSD device by its per-OSD UUID and refuse duplicate data directories, so a reused ID cannot direct a key write at old data
fixvalidate lockbox values as cephx keys rather than accepting any base64 data, and redact lockbox keys from LVM error output to keep them out of task logs and bug reports
breakingask for the checks that prove an OSD is gone before its leftover lockbox key is removed, and no longer suggest removing the authentication entry of a daemon that only seems gone
otherceph: osd: on destroy, remove the empty mount-point directory and the runtime unit enablement ceph-volume left behind, so the OSD stops being reported as a configured service before the next boot
9.2.14 Aug 28, 2026
otherceph: cephx key migration:
otherstop reporting an abort that never happened at the end of every apply run, which the lock heartbeat printed when the run released it
othernever remove the lockbox tag of an encrypted OSD when asked to write the key it already holds, and refuse a value that is not a key, so a mistake cannot leave that OSD unable to unlock
9.2.13 Aug 28, 2026
featurepartially fix #1989: ui: qemu: allow configuring the qcow2 cache size when creating or editing a disk, either directly or derived from the disk size, which can improve performance considerably for some guests
otherapi: apt: accept the HTTP proxy as a URI, so that a password can contain special characters
otherceph: cephx key migration:
featureadd '--rotate-lockbox-keys' to migrate the 'client.osd-lockbox' key of an encrypted OSD. That key lives in the authentication database and in an LVM tag on the OSD's block device that ceph-volume rebuilds the keyring from, so rotating only the entry left the OSD unable to unlock, and recreating it…
otherlist the options that are still open when a run finishes, so that ending the migration does not mean looking up which key groups are left
otherrecover the admin keyring through the 'mon.' credential when a run was interrupted while rotating 'client.admin', which left the cluster without a usable admin key before
othercommit rather than drop a pending key when a live key swap was interrupted after the key reached the bluestore label, as the OSD data directory is rebuilt from that label at boot
otherplan a newer interrupted rotation of an entity even if an older run finished one, for example after a key reset by hand or a reused OSD id
otherrequire every monitor in quorum only for a monitor key rotation, so a cluster with one monitor down can still migrate its daemon keys
otherreport daemons and nodes whose Ceph version or kernel could not be verified apart from those known to be outdated
otherrestore 'auth_preferred_cipher' also when a run fails, and refuse to continue over an unknown recorded value instead of dropping it
otherhold a second apply run on any node back through a lock on the cluster file system, and take the node's bulk restart lock as well, so that a rolling restart from the web interface cannot start there meanwhile
otherrecord which OSDs a run sets 'noout' on before setting it, so that a hard kill in between cannot leave the flag without a record to clean up from
featurerotate the standby managers before the active one, so that a failover lands on a manager that already carries the new key
otherreport whether an authentication check is still an error from what the run itself confirmed, as the monitors recompute on their own tick
othercut the output of a run down to what decides whether to proceed
9.2.12 Aug 22, 2026
fixfix #7136: ui: tree: harmonize folder view resource ordering
fixfix #6113: ui: import: allow selecting a resource pool when importing a guest from an OVA file or from VMware ESXi
otherceph: rolling restart:
featureallow a restart on a cluster whose only errors are the cephx cipher health checks that Ceph 19.2.6 and 20.2.4 raise. Those made every upgraded cluster report HEALTH_ERR, which blocked every rolling restart, so one could not be finished and left daemons on mixed versions
otherjudge each health check on its own severity instead of on the overall cluster status
otherignore health checks that Ceph itself has muted
otherevaluate the OSD map flags only for an OSD restart, as they do not affect monitor quorum, manager failover or MDS takeover. A 'nodown' set to stop OSDs from flapping no longer blocks a monitor restart
otherreport per daemon type whether a check blocks a restart, so the web interface only warns about what applies to the restart at hand
otheronly clear the 'noout' flags the restart set itself. A flag an operator had set on a single OSD, to stop it flapping or while working on its disk, was cleared as soon as any rolling restart finished
featureceph: allow muting and unmuting a health check from the web interface and the API. A muted check is still evaluated and reported, but it no longer counts towards the overall cluster status. That is the only answer for a check that cannot be acted on, and it was previously only possible on the…
featureceph: add 'pveceph auth status', a read-only report on which cephx keys still use the old cipher, whether they can be migrated yet, and what is holding that up, including the kernel version of every node.
fixceph: add a guided helper to migrate the cephx service keys to the aes256k cipher: /usr/share/pve-manager/migrations/pve-cephx-rotate-service-keys It goes through the daemons of the whole cluster one at a time and can be narrowed to a single daemon type or a single daemon. It runs as a dry run…
otherpve8to9: name the cephx key migration health checks instead of asking to resolve them, as an upgraded cluster reports its unmigrated keys as insecure and the client keys cannot be migrated at all on a Bookworm kernel.
fixfix #7927: ui: sdn prefix-lists: change the prefix format to allow bigger subnets, covering the full CIDR prefix range including 0.0.0.0/0.
9.2.11 Aug 14, 2026
otherui: certificates, lxc DNS, VM cloud-init and PCI: encode rendered values with htmlEncode.
featureui: acme: use improved URL rendering implementation from proxmox-widget-toolkit.
9.2.10 Aug 7, 2026
otherpveperf: make bogomips regular expression case insensitive, other architectures like Loong64 use different capitalization
otherui: LXC templates: hide foreign architectures by default, arm64 and amd64 look very similar and can be easily confused
otherui: appliance templates: rename the "Package" column to "Name"
featureui: LXC templates: add a search hint to the "download" dialogue and widen the search input field
breakingapi: ceph: mds: deprecate hotstandby parameter in the API schema, and do not set the mds_standby_for_name and mds_standby_replay config options any more, they were removed in Ceph 14.1 and setting them has no effect any more
9.2.9 Aug 3, 2026
breakingui: qemu: default aarch64 VMs to a KVM-usable CPU model instead of one that QEMU rejects at start, and warn when an incompatible ARM CPU model is selected.
9.2.7 Aug 2, 2026
featureceph: when installing, offer only the Ceph releases that have packages for the node's architecture, from a new per-node API endpoint instead of a hardcoded list, so an arm64 node no longer lists releases without an arm64 build.
othersubscription: bind keys to a CPU architecture; arm64 keys carry an explicit marker, and a key that does not match the node's architecture is rejected in the API and CLI and flagged early in the web interface.
othercontainers: show the appliance template architecture in "pveam available" and the template selector, and point out when it differs from the node it would run on.
fixfix #7187: add the ethtool output for physical network interfaces to the system report, to help debug link and offloading issues.
featureadd tooltips describing the acceleration modes to the VM CPU flag selector.
otherpvesh: support API paths whose parameters are described through composed 'allOf' or 'oneOf' schemas, which the HA rules endpoints use as of libpve-common-perl 9.1.21, so that their options keep being accepted.
9.2.6 Jul 31, 2026
otherfabrics: wireguard: node edit: use network selector for internal nodes, making the semantics of the field more obvious, and entering values less error-prone and manual.
otherapi: apt: versions: track proxmox-enterprise-support-keyring version
featureui: ha: node affinity: refactor and extend UI, allow configuring "positive" or "negative" affinity rules. negative affinity allows declaring nodes on which HA resources must not (strict rule) or should not (non-strict) run on.
featureui: ha: resource affinity: add hint for affinity type config value, mapping "positive" to "Keep Together", and "negative" to "Keep Separate", like the create/edit dialogue already did before.
otherui: ceph: pool: set target ratio to 0 when the value is not set, to explicitly clear the value instead of not sending the value to the backend and keeping the previous value set.
9.2.5 Jul 15, 2026
featureceph: add guided rolling-restart for Ceph daemons, available both from the API and the web interface, so operators can safely cycle all OSDs, monitors, managers or metadata servers of a cluster after a configuration or kernel change without hand-rolled scripts. Each step waits for the previous…
fixceph: osd: drop two obsolete cleanup workarounds now handled elsewhere: Ceph itself runs 'pvremove' while zapping an OSD, so our own call could fail on an already-removed physical volume, and the udev trigger worked around a systemd bug fixed long ago.
otherceph: skip re-broadcasting the Ceph service status to the cluster file system on every pvestatd cycle when nothing changed, avoiding needless pmxcfs writes.
fixfix #6948: ui: ceph: configuration database: automatically show the MASK column once any entry uses a mask, so masked settings such as 'osd/class:hdd' are no longer indistinguishable from cluster-wide ones.
fixui: sdn: fabrics: fix adding and editing BGP unnumbered interfaces, which carry no per-interface IP address. The IPv4 column is now optional and stale 'ip'/'ip6' properties are no longer submitted, which previously made the backend reject the interface as not defined in the schema.
otherapi: sdn: avoid a double slash in delete request URIs, which a strict firewall or proxy could reject even though the server normalizes it.
fixfix #7460: ui: sdn: point the BGP and IS-IS controller help buttons to their own documentation sections instead of the EVPN one.
otherui: VM boot order: hint that OVMF (UEFI) guests need a virtual RNG device for PXE network boot to work.
otherui: VM vCPU: drop the artificial upper limit on the socket count in the edit dialog, matching the backend which imposes none.
featurepostinst: add kernel NBD devices to the global LVM filter on new installations, to avoid clashes with volume groups on NBD-mapped external disks, for example nested Proxmox VE systems or disks accessed by external backup providers.
otherupdate shipped appliance info index.
9.2.4 Jun 29, 2026
fixfix #4130: external metric server: keep node status updates flowing when a TCP metric server is unreachable. A failed connection previously raised an unhandled exception that aborted the whole node status update, so storage and guest status indicators in the UI eventually turned gray.
fixfix #6348: ui: bulk action: render the resource tags in the selection list using the configured tag style instead of plain text.
featureui: node: show the system log in a structured journal view that colors entries by syslog priority and adds server-side filters for the minimum priority, a systemd unit, a syslog identifier and kernel-only messages, with autocompletion for the unit and identifier filters.
otherui: node: open a service's log in that structured journal view, scoped to the service's systemd unit, instead of as plain text.
otherui: VM CPU flag selector: replace the per-flag radio group and the separate read-only state column with a single Off/Default/On segmented button that both shows and sets the state, and re-enable column sorting.
otherui: custom CPU model: validate the name in the creation dialog against the allowed config-ID format, rejecting invalid names in the frontend instead of only after the backend refuses them.
fixui: sdn: fabrics: fix editing a node interface that already has an IPv6 address, which did not show up and failed to submit because the field was named 'ipv6' instead of the 'ip6' the schema expects, and label the interface address column 'IPv4' instead of the ambiguous 'IP'.
fixui: fix the QEMU version comparison behind the dynamic USB port limit, which wrongly required the minor version to also be greater or equal even when the major version was already newer, so the higher USB port count for capable machine and OS types was not offered.
otherui: stop displaying a misleading 0% disk usage for VMs in the resource views; the field is left empty again, as VM disk usage is not currently queried from the guest agent.
9.2.3 May 24, 2026
featureui: storage content: show the owning guest of a volume and add an action to jump to it.
otherapi schema: cluster options: declare the actual return schema type.
9.2.2 May 21, 2026
featuresdn: fabrics: wireguard: drop the separate endpoint-port field added to the node-edit window in 9.1.19. The underlying schema change in proxmox-ve-config has been reverted: the endpoint now stores only the host, and the connect port is derived from the referenced interface's listen_port at…
featuresdn: fabrics: tighten the fabric and node configuration forms: require at least one prefix, hide node address fields for prefix families that are not configured on the fabric, and disable prefix editing once nodes have been added (since changing the prefix would invalidate existing nodes).
otherui: VM CPU flag selector: disable column sorting as a stop-gap, since sorting and then editing a flag could leave the radio-button widgets in moved rows showing the wrong selected state.
featureLatest 7.0 Kernel as new stable default
featureDynamic Load Balancing with the Cluster Resource Scheduler (CRS). In dynamic scheduling mode, the CRS uses real-time node and guest resource utilization metrics to balance HA-managed guests. The new load balancer can automatically migrate HA-managed guests to lower the overall node imbalance…
featureNumerous improvements to the Software Defined Networking (SDN) stack: Add WireGuard and BGP as new fabric protocols. Add support for route maps and prefix lists for fine-grained BGP/EVPN route filtering. Further additions include route redistribution for OSPF fabrics, additional options for…
featureManagement of custom CPU models from the web interface. A new section in the Datacenter → Guest Resources/Hardware allows creating, editing, and removing custom CPU models from the web interface. Custom CPU models allow tailoring the virtual CPU exposed to VMs to a specific set of features. The VM…
featureDisarm and arm HA for safer cluster maintenance. The HA stack can now be disarmed cluster-wide via the new disarm-ha and arm-ha CRM commands. This allows for planned, cluster-wide maintenance work, such as changes in the cluster network, without triggering any node fencing events. The HA resource…
featureKernel 7.0 as new stable default.
featureCeph Tentacle 20.2.1 is available as stable option.
featureExpose the parallel worker count for all bulk actions, not only for bulk migrations. An empty value falls back to the new auto default, which preserves backwards-compatibility with older nodes in a mixed-version cluster.
featureMake several improvements to the task viewer:
featureAdd a Download button to download a task log directly without opening the full task viewer popup (issue 7087).
featureDerive the task end-time from the polled task status if the caller did not provide it, ensuring finished tasks show the correct duration.
featureMake various improvements to the login flow:
featurePreserve deep-link fragments (e.g. /#vNNN) across an OpenID Connect login to make users land on the requested resource (issue 7337).
featurePrevent the realm selection from being changed on the login page as a side-effect of unrelated user creation (issue 7149).
featureReset the UI state on automatic logout to protect users who share a workstation.
featureAllow creating snapshots and backups directly from the resource tree context menu (issue 6209).
featureImprove the rendering of nested pools in the resource view by grouping the child pools under their parent pool.
featureAdd an architecture column to the resource store, enabling other views to display the architecture of a node.
featureFix the OSD toolbar overflowing on narrow viewports.
featureFix the CephFS page not being scrollable when multiple MDS are configured (issue 6234).
featureFix sorting of the Two-Factor Authentication (TFA) column in the datacenter, permission, and user grids (issue 7191).
featureFix the network section being unavailable in the folder view (issue 7125).
featureImprove the "Confirm Remove" dialog layout to properly accommodate larger fields and components.
featureAllow creating network bonds without specifying the bond-primary option to match the backend, which treats the value as optional (issue 4911).
featureUse the correct IANA timezone name Europe/Kyiv in the timezone selector (issue 7141).
featureSmaller fixes and improvements:
featureFix parsing of property strings whose values contain an equals sign.
featureTrim trailing whitespace from custom filenames when downloading ISOs, so the file extension is recognized correctly.
featureInclude Linux Kernel 7.x in the version range for the VM OS selector.
featureFix a typo in a translated OVMF-related error message.
securityFix a boot issue for Windows guests with Virtualization-based Security (VBS) enabled by disabling the cet-ibt and cet-ss CPU flags.
deprecatedSwitch from the deprecated block-job-complete to the newer job-complete QMP command.
breakingRemove redundant checks for USB hotplug support and unplug events during unrelated VM configuration changes.
deprecatedDeprecate and warn about raw cgroup v1 entries in the container configuration. The support for cgroup v1 will be removed in a future release.
securityPrevent local "copy.fail" privilege escalation exploit via AF_ALG sockets within containers by using seccomp filtering (PSA-2026-00018-1). If AF_ALG support is required in a specific container, see the security advisory forum post for more details.
deprecatedSwitch from the deprecated /etc/timezone to the recommended timedatectl to initialize the containers timezone setting (issue 7175).
deprecatedDeprecate the legacy starttime and dow parameters of the backup job API in favor of schedule. The legacy parameters were superseded by schedule since Proxmox VE 7.1 and have now been removed from the API response.
breakingWindows VMs using machine versions 11.0 or 11.0+pve1 are potentially affected by this issue. Such guests may have been created with the packages available in the Proxmox VE 9.2 ISO or qemu-server older than 9.2.0. Upgrading the qemu-server package and setting the machine version to 11.0+pve2 or…
breakingWindows VMs using machine version 11.0+pve2 or newer are not affected by this issue. Under qemu-server 9.2.0 or later, new Windows VMs are created with an unaffected machine version.
breakingWindows VMs using machine versions older than 11.0 are not affected if using qemu-server 9.2.0 or newer.
+143 more items in the release notes