CVE-2026-51083
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Incorrect access control in Proxmox Virtual Environment (PVE) 9.x qemu-server before 9.1.8 and 8.x before 8.4.8 allows users with limited privileges to obtain hashed passwords via the cloudinit/dump API.
Risk Assessment
The risk involves potential leakage of hashed passwords, which could lead to unauthorized access to virtual systems and privilege escalation within the Proxmox environment.
Recommendation
It is recommended to immediately update Proxmox Virtual Environment to version 9.1.8 or later (for 9.x) and 8.4.8 or later (for 8.x) to remediate the vulnerability.
Other vulnerabilities in Proxmox Virtual Environment
See all- CVE-2022-31358Critical
A reflected cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment prior to v7.2-3 allows remote attackers to execute arbitrary web scripts or HTML via non-existent endpoints under path /api2/html/.
- CVE-2026-51082High
A race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment (PVE) 9.x and 8.x allows an attacker with privileges to call vncproxy to hijack a VNC session established in parallel by a different user for a different VM.
- CVE-2026-51081Medium
A cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment (PVE) 9.x 5.1.8 and 8.x 4.3.16 allows attackers to inject malicious scripts or HTML. The flaw exists in input handling, enabling arbitrary code execution in the victim's browser.
Original NVD description (English source)
Incorrect access control in Proxmox Virtual Environment (PVE) 9.x qemu-server before 9.1.8 and 8.x before 8.4.8 allows users within limited privileges to obtain hashed passwords via the cloudinit/dump API.