CVE-2026-51082

HIGH

Proxmox VE pve-manager <9.1.9/8.4.19 - VNC Proxy/WebSocket Race Condition Session Hijacking

Title source: llm

Description

A race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment (PVE) 9.x pve-manager before 9.1.9 and 8.x before 8.4.19; qemu-server 9.x before 9.1.7 and 8.x before 8.4.7; and pve-container before 6.1.3 (PVE 9.x) and before 5.3.4 (PVE 8.x) allows an attacker with privileges to call "vncproxy" to hijack a VNC session that is established in parallel by a different user for a different VM.

References (1)

Core 1

Core References

https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/post-849971

Scores

CVSS v3 7.2

EPSS 0.0022

EPSS Percentile 12.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-362

Status published

Published Jul 17, 2026

Tracked Since Jul 17, 2026