CVE-2026-51082: Race Condition
A race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment (PVE) 9.x pve-manager before 9.1.9 and 8.x before 8.4.19; qemu-server 9.x before 9.1.7 and 8.x before 8.4.7; and pve-container before 6.1.3 (PVE 9.x) and before 5.3.4 (PVE 8.x) allows an attacker with privileges to call "vncproxy" to hijack a VNC session that is established in parallel by a different user for a different VM.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-51082?
CVE-2026-51082 has a high severity rating of 7.2 according to CVSS 3.1.
How do I fix CVE-2026-51082?
To fix CVE-2026-51082, upgrade Proxmox Virtual Environment to versions 9.1.9 or 9.1.7 for qemu-server, and ensure pve-container is updated to 6.1.3 or 5.3.4 for PVE 8.x.
What systems are affected by CVE-2026-51082?
CVE-2026-51082 affects Proxmox Virtual Environment versions 9.x before 9.1.9, 8.x before 8.4.19, qemu-server versions 9.x before 9.1.7 and 8.x before 8.4.7, and pve-container before 6.1.3 and 5.3.4.
What type of vulnerability is CVE-2026-51082?
CVE-2026-51082 is characterized as a race condition vulnerability.
Who can exploit CVE-2026-51082?
CVE-2026-51082 can be exploited by an attacker with privileged access to the affected systems.