CVE-2026-51082

Executive Summary

CVE-2026-51082 is a high-severity race condition (CVSS 7.2) in the VNC proxy subsystem of Proxmox Virtual Environment (PVE), affecting pve-manager, qemu-server, and pve-container packages across versions 8.x and 9.x. An authenticated attacker with privileges to invoke the vncproxy API can exploit a time-of-check-time-of-use (TOCTOU) flaw to hijack an active VNC session established in parallel by a different user for a different virtual machine. This allows complete session takeover, enabling the attacker to inject keystrokes, exfiltrate VM console data, and potentially pivot into the guest operating system with the privileges of the legitimate console operator. All self-hosted Proxmox environments running affected package versions are vulnerable; no patch is currently available from tracked sources, though upstream version numbers indicate a fix is imminent.

Technical Analysis

The vulnerability resides in the VNC session management logic of Proxmox's pve-manager (specifically in the API endpoint handlers for vncproxy and vncwebsocket) and is jointly triggered with the qemu-server and pve-container packages that implement the underlying VM/container console abstraction.

Vulnerability Mechanism (TOCTOU Race Condition): The vncproxy API call creates a VNC proxy tunnel between the client and a target VM's QEMU process or a container's terminal. Internally, the function performs a two-step sequence:

1. Authorization check: Validates that the requesting user has VM.Console or equivalent privileges on the target VM/CT ID.
2. Session binding: Binds an ephemeral VNC port and associates it with the requesting session's ticket/user.

The race condition occurs because between steps 1 and 2, the code queries and caches the VM/CT configuration from the cluster configuration database (/etc/pve/qemu-server/<VMID>.conf or LXC config). If an attacker calls vncproxy with a valid, privileged VMID (e.g., a VM they own) and, in rapid succession, the same call is made for a target victim's VMID, the proxy binding logic can be tricked into associating the attacker's authenticated session token with the victim's VNC port.

The root cause is a missing mutex or atomic locking around the session-map data structure that stores (ticket → [VMID, port]) associations. Because the proxy session store is a global hash in the pve-manager process, concurrent invocations for different VMIDs can interleave: the attacker's vncproxy call for VM A may inherit the port allocation intended for the victim's call for VM B. The attacker then connects to that port, and because the access-control check was performed for VM A (which they own), the check passes.

The flaw specifically affects the pve-container package because LXC containers are often accessed via VNC-style terminal proxies (using lxc-console), extending the attack surface beyond full VM consoles.

Attack Surface: The affected API endpoints are exposed on the PVE web server (pveproxy daemon, TCP 8006) and the WebSocket upgrade path (TCP 8006 with Upgrade: websocket). Authentication is required (any user with PVEVMUser or PVEAuditor role plus explicit console permissions on at least one VM/CT), making this a post-authentication privilege escalation and lateral-movement vector. The attacker does not need rights to the victim's VM; they only need rights to any VM/CT to initiate the race.

Exploitation Scenarios

Scenario: Cross-Tenant VM Console Hijacking on a Multi-Tenant Proxmox Host

1. Reconnaissance:
   The attacker authenticates to the PVE API at https://<pve>:8006/api2/json/ using a low-privilege account that has console access to at least one VM they control (VMID e.g., 100). They enumerate the cluster via GET /api2/json/cluster/resources to identify victim VM IDs (e.g., VMID 200) running on the same node.

2. Weaponization & Trigger:
   The attacker writes a script that sends two concurrent HTTP requests to the API endpoint /api2/json/nodes/<node>/qemu/<vmid>/vncproxy:

   • Request A for VMID 100 (attacker-owned, passes authz check).
   • Request B for VMID 200 (victim, would fail authz check if evaluated correctly).
     Using Python's asyncio or threading, they fire both requests within the same microsecond window. Because the server's request handler performs the authz check for each request but the session-map insertion is not atomic, Request B's proxy session can be inserted into the map entry that Request A's response references. Both requests return a port and ticket; the attacker takes the response of Request A (which passed authz) and discards Request B's response.

3. Session Binding:
   The attacker now opens a WebSocket connection to wss://<pve>:8006/?console=vnc&vncticket=<ticket_A>&port=<port_A> using the ticket returned by Request A. The server validates the ticket, finds it in the session map, and—due to the race-corrupted mapping—associates it with the VNC port of VMID 200. The WebSocket handshake succeeds, and the attacker receives the VNC framebuffer for the victim's VM console.

4. Post-Exploitation Impact:
   If the victim's VM has a graphical console active (e.g., an operator is logged into a Windows/Ubuntu desktop session inside the VM), the attacker now has a full interactive VNC session. They can:

   • Inject keystrokes (e.g., Ctrl+Alt+Del, then credentials to pivot to another user account).
   • Read the screen (steal credentials, sensitive data displayed on the console).
   • Use the clipboard (VNC clipboard sharing) to exfiltrate data.
   • Disconnect the legitimate user, causing a denial-of-service for the VM operator.
   • For LXC containers, the same attack via pve-container allows terminal execution within the container's lxc-console.

Conditional trigger nuance: The race window is microseconds to a few milliseconds, but because the proxy session map is a shared in-memory structure, repeated retry loops (hundreds of attempts) will eventually succeed. The attacker can automate this with a loop, making successful exploitation a probabilistic but practical matter.

Impact Assessment

Business Impact: This vulnerability enables a privileged tenant on a shared Proxmox host to compromise the confidentiality, integrity, and availability of all other VMs/containers on the same node. In multi-tenant environments (hosting providers, managed service providers), this constitutes cross-tenant isolation breach, directly violating separation-of-duty guarantees.

CVSS Subscore Analysis:

• C:H / I:H / A:H — Full session takeover granting read/write to VM consoles and the ability to terminate sessions.
• PR:H — Requires an authenticated account with console privileges on at least one VM/CT; mitigates unauthenticated remote exploitation.
• AC:H — The race condition requires precise timing, but automated retries negate this difficulty in practice.

Blast Radius: Any VM or container whose console is concurrently accessed (even by the VM's own admin) during the attack window is affected. The flaw does not require the victim VM to be running a VNC server externally; the attack targets the PVE management plane itself. Recovery requires terminating all VNC proxy processes and re-authenticating sessions.

Detection Guidance

Sigma Rule

title: Proxmox VNC Proxy Session Race Condition Exploitation Attempt
id: 8f5a1e2c-9b3d-4f6a-8c2e-1a9b7d5e3f21
status: experimental
description: Detects rapid concurrent vncproxy API calls for different VMIDs, indicating a race condition exploitation attempt for CVE-2026-51082.
author: Valtersit Threat Intel Team
date: 2026/02/15
logsource:
  category: process_creation
  product: linux
  service: pveproxy
detection:
  selection:
    Image|contains: 'pveproxy'
    CommandLine|contains: 'vncproxy'
  filter_legit:
    CommandLine|contains:
      - 'vncproxy?*vmid='
  condition: selection and not filter_legit
  timeframe: 5s
  aggregation:
    group by: src_ip
    count: 5
    threshold: 10
level: high
falsepositives:
  - Legitimate bulk operations by automation tools operating on multiple VMs in rapid succession
  - Cluster migrations initiating console proxies for multiple VMs
tags:
  - attack.privilege_escalation
  - attack.t1068
  - cve.2026.51082

YARA Rule

rule Proxmox_VNCProxy_Race_Exploit_Code {
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects scripted exploit code targeting CVE-2026-51082 race condition"
        date = "2026-02-15"
        reference = "CVE-2026-51082"
    strings:
        $s1 = "vncproxy" ascii nocase
        $s2 = "vncticket" ascii nocase
        $s3 = "asyncio" ascii nocase
        $s4 = "gather" ascii nocase
        $s5 = "vmid" ascii nocase
        $s6 = "race" ascii nocase
        $s7 = "proxmox" ascii nocase
    condition:
        all of ($s1, $s2, $s5) and 2 of ($s3, $s4, $s6, $s7)
}

Suricata IDS Rule

alert http any any -> $HOME_NET 8006 (msg:"PROXMOX CVE-2026-51082 VNC Proxy Race Attempt - Concurrent Different VMIDs"; flow:to_server,established; content:"POST"; http_method; content:"vncproxy"; http_uri; content:"vmid="; http_uri; threshold:type threshold, track by_src, count 20, seconds 5; reference:cve,CVE-2026-51082; classtype:attempted-privilege-grant; sid:5300001; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=2s
  [any where process.name : "pveproxy" and url.path : "*vncproxy*" and url.query : "*vmid=*"]
  [any where process.name : "pveproxy" and url.path : "*vncproxy*" and url.query : "vmid!=" + previous.url.query]

Splunk SPL Query

index=proxmox sourcetype=pveproxy
| where like(_raw, "%vncproxy%")
| rex field=_raw "vmid=(?<vmid>\d+)"
| rex field=_raw "src_ip=(?<src_ip>[^ ]+)"
| stats dc(vmid) as distinct_vmids values(vmid) as vmids by src_ip, _time
| where distinct_vmids > 2
| where _time >= relative_time(now(), "-5s")

Wazuh OSSEC Rule

<group name="proxmox,">
  <rule id="308574" level="12">
    <decoded_as>json</decoded_as>
    <match>vncproxy</match>
    <field name="event">vnc_proxy_call</field>
    <same_source_ip />
    <description>Proxmox CVE-2026-51082: Multiple vncproxy calls from same source to different VMIDs detected - potential race condition exploitation</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>vulnerability,exploit,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Official package repositories indicate that fixed versions exist upstream (9.1.9, 8.4.19, etc.), but no patch has been released to public mirrors or CHANGELOGs as of this report. Monitor Proxmox mailing lists for immediate CVE-2026-51082 advisories.

1. Immediate Mitigations (compensating controls until patch):

   • Restrict API access: Block direct access to the PVE API (port 8006) from untrusted networks. Use a reverse proxy or VPN with strict allow-lists for authenticated users.
   • Disable WebSocket connections to non-admin users where operationally feasible: set console: 3 in /etc/pve/datacenter.cfg to disable console access for all users except root@pam.
   • Audit existing accounts: review all users with VM.Console permissions; remove access for accounts that do not require console operations.
   • Enable two-factor authentication (TOTP) for all PVE accounts to increase the attacker's access friction.

2. Patch/Upgrade Steps:

   • When the fix is released, upgrade promptly (order matters):

     apt update
     apt install pve-manager=9.1.9 qemu-server=9.1.7 pve-container=6.1.3
     systemctl restart pveproxy
     

   • For 8.4 LTS branches, the equivalents are pve-manager=8.4.19, qemu-server=8.4.7, pve-container=5.3.4.
   • Verify patched versions: pveversion -v and confirm the three package versions align with the fixed versions above. Restart all running VMs/CTs after the patch to purge lingering proxy sessions.

3. Long-Term Hardening:

   • Enable Proxmox's built-in firewall (/etc/pve/firewall/cluster.fw) to restrict API access to management VLANs only.
   • Implement an IDS/IPS (e.g., Suricata in front of port 8006) with the provided detection rules.
   • Rotate VNC tickets: configure vnc: 1 in /etc/pve/datacenter.cfg to force per-session ticket regeneration.
   • For multi-tenant deployments, consider full VXLAN/VLAN isolation where each tenant gets their own Proxmox node to eliminate shared-host risk.

References

• Proxmox Security Advisory (pending publication): https://pve.proxmox.com/wiki/Security
• NVD Entry for CVE-2026-51082: https://nvd.nist.gov/vuln/detail/CVE-2026-51082
• MITRE CVE Record: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-51082
• Proxmox Package Changelogs (delayed release): https://pve.proxmox.com/wiki/Roadmap
• CISA KEV Catalog (CVE not listed as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Campaigns: No active exploitation in the wild has been confirmed. EPSS score of 0.00221 (12.8% percentile) indicates a low immediate probability of exploitation; however, the attack class (TOCTOU race condition) is well-understood and weaponizable by APT groups targeting virtualized infrastructure. Monitor any public PoC releases on GitHub and exploit-db, as this CVE is a prime candidate for researcher weaponization.