Race Condition Vulnerability in Proxmox Virtual Environment Affecting VNC Sessions
CVE-2026-51082

7.2HIGH

Key Information:

Vendor

Proxmox

Status
Proxmox Virtual Environment
Vendor
CVE Published:
17 July 2026

What is CVE-2026-51082?

In Proxmox Virtual Environment (PVE), a race condition exists between the vncproxy and vncwebsocket API calls. This can be exploited by a user with privileges to call 'vncproxy', enabling them to hijack an active VNC session established by another user on a different virtual machine (VM). This vulnerability affects multiple versions of pve-manager, qemu-server, and pve-container, making it crucial for users to apply available security updates to mitigate potential unauthorized access to VNC sessions.

References

https://forum.proxmox.com/threads/proxmox-virtual-environ...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.