CVE-2026-51082
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment (PVE) 9.x and 8.x allows an attacker with privileges to call vncproxy to hijack a VNC session established in parallel by a different user for a different VM.
Risk Assessment
The risk involves unauthorized access to another VM's VNC console, potentially leading to data leakage, VM takeover, or privilege escalation within the virtualized environment.
Recommendation
Immediately update pve-manager to version 9.1.9 (for PVE 9.x) or 8.4.19 (for PVE 8.x), qemu-server to version 9.1.7 or 8.4.7, and pve-container to version 6.1.3 (PVE 9.x) or 5.3.4 (PVE 8.x).
Other vulnerabilities in Proxmox Virtual Environment
See all- CVE-2022-31358Critical
A reflected cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment prior to v7.2-3 allows remote attackers to execute arbitrary web scripts or HTML via non-existent endpoints under path /api2/html/.
- CVE-2026-51083Medium
Incorrect access control in Proxmox Virtual Environment (PVE) 9.x qemu-server before 9.1.8 and 8.x before 8.4.8 allows users with limited privileges to obtain hashed passwords via the cloudinit/dump API.
- CVE-2026-51081Medium
A cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment (PVE) 9.x 5.1.8 and 8.x 4.3.16 allows attackers to inject malicious scripts or HTML. The flaw exists in input handling, enabling arbitrary code execution in the victim's browser.
Original NVD description (English source)
A race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment (PVE) 9.x pve-manager before 9.1.9 and 8.x before 8.4.19; qemu-server 9.x before 9.1.7 and 8.x before 8.4.7; and pve-container before 6.1.3 (PVE 9.x) and before 5.3.4 (PVE 8.x) allows an attacker with privileges to call "vncproxy" to hijack a VNC session that is established in parallel by a different user for a different VM.