CVE-2026-51083

Executive Summary

CVE-2026-51083 is an incorrect access control vulnerability in Proxmox Virtual Environment (PVE) affecting the qemu-server package. Versions 9.x before 9.1.8 and 8.x before 8.4.8 permit users with limited privileges to obtain hashed passwords via the cloudinit/dump API. This flaw enables authenticated low-privileged users to extract password hashes belonging to other users, facilitating offline brute-force attacks and privilege escalation. Enterprise environments running Proxmox VE clusters with multi-tenant user models, or where API access is delegated to non-admin staff, are at elevated risk. The CVSS score of 6.5 (Medium) reflects the requirement for authenticated access but underscores the severe confidentiality impact on credential material.

Technical Analysis

The vulnerability resides in the access control mechanisms governing Proxmox VE's cloudinit/dump API endpoint within the qemu-server package. Proxmox VE provides an API layer that allows users to manage virtual machines, including their cloud-init configuration. Cloud-init is widely used to seed VMs with user accounts, SSH keys, and — critically — password hashes for initial authentication.

The /nodes/{node}/qemu/{vmid}/cloudinit/dump endpoint is designed to dump cloud-init configuration data for a given VM. The defect is that the authorization check does not properly verify that the requesting user has sufficient privileges (typically VM.Audit or equivalent role permissions) on the specific VM resource. Instead, the endpoint incorrectly assumes that an authenticated user requesting the dump has the appropriate rights, or it fails to scope the request to the VM ownership and permission model.

Within the qemu-server codebase, the affected code path processes the API request by serializing the cloud-init configuration into a downloadable dump format. Because cloud-init configurations frequently contain chpasswd entries with SHA-512 hashed passwords (used to set the root or user passwords on first boot), the dump API returns these hashes alongside the rest of the configuration. A low-privileged user — for instance, one holding the PVEVMUser role on a single VM or a user with PVEDatastoreUser — can traverse or target another VM's cloud-init configuration if the endpoint does not enforce resource-level authorization correctly.

The attack surface is the HTTPS API (port 8006) and the web UI, which proxies the same API. The vulnerability is triggered via a crafted API call, such as:

GET /api2/json/nodes/{node}/qemu/{vmid}/cloudinit/dump?type=config

The lack of granular permission checks means the cloudinit/dump handler does not verify that the authenticated user has VM.Audit or VM.Console privileges on the target VM ID. This is a classical Insecure Direct Object Reference (IDOR) pattern, where the vmid parameter is user-supplied and not validated against an access control list.

Notably, the affected versions span two major release lines (8.x and 9.x), indicating this is not a regression in a single branch but a systemic flaw in the API design or its shared library (pve-access-control or similar). The fix in 9.1.8 and 8.4.8 presumably adds the missing permission check on the VM resource before serving the cloud-init dump. The CWE classification is unknown per the advisory, but the vulnerability class aligns with CWE-284 (Improper Access Control) or CWE-639 (Authorization Bypass Through User-Controlled Key).

Exploitation Scenarios

Attack Chain: Credential Harvesting and Privilege Escalation

1. Reconnaissance and Target Identification: The attacker is an authenticated low-privileged user on the Proxmox VE cluster. This could be a tenant user, a delegated operator, or a compromised API token. The attacker enumerates running VMs via the authenticated API call: GET /api2/json/nodes followed by GET /api2/json/nodes/{node}/qemu. This requires the VM.Audit role on at least one VM or the global PVEAuditor role, which is commonly granted. The attacker identifies high-value VM IDs (e.g., infrastructure servers, domain controllers, or admin workstations) by their naming conventions or by inspecting VM configuration descriptions.

2. Trigger and Weaponization: The attacker crafts requests to the vulnerable endpoint, iterating through VM IDs. For each candidate, they issue:

   GET /api2/json/nodes/{node}/qemu/{vmid}/cloudinit/dump?type=config
   

   The response contains the full cloud-init configuration, including a chpasswd section. This section may look like:

   chpasswd:
     expire: false
     users:
       - name: root
         password: $6$rounds=656000$Vf8kS4x... (SHA-512 hash)
         type: text
   

   The attacker saves these hashes. If the type=config parameter fails, they try type=user or omit the parameter entirely.

3. Payload and Execution: Offline, the attacker runs a password cracking tool (e.g., John the Ripper or hashcat with mode -m 1800 for SHA-512 crypt) against the extracted hashes. Proxmox default user passwords (e.g., root) are frequently weak. Alternatively, if the hash corresponds to a service account or a user with elevated PVE roles, cracking it yields a valid session.

4. Post-Exploitation Impact: Once the attacker cracks a hash, they authenticate as that user. If the cracked account has admin rights (Administrator role), the attacker gains full control over all VMs, storage, and the hypervisor. They can then dump VM disks, inject malware into guest OS images, exfiltrate data, or pivot into the internal network. Even if the cracked account is only a mid-level user, the attacker now has a legitimate identity, making lateral movement within the PVE environment easier and increasing the risk of subsequent attacks.

Alternative vector: In environments where VMs are provisioned with cloud-init and passwords are set programmatically at first boot, the hashes may be reused across multiple VMs or match the template's root password. The attacker can test the same hash across multiple VM IDs, increasing the odds of cracking a match.

Impact Assessment

The vulnerability has a CVSS base score of 6.5 (Medium), reflecting the need for authenticated access. The vector is currently marked as UNKNOWN in available data; however, based on the NVD description, the likely vector components are: AV:N (network access via the API), AC:L (no special conditions), PR:L (low privileges required), UI:N (no user interaction), S:U (scope unchanged), C:H (high confidentiality impact — password hashes exposed), I:N (no integrity impact), and A:N (no availability impact). The primary loss is confidentiality of credential material.

Business Impact: Compromised password hashes represent a significant security event. Even with strong password policies, SHA-512 (crypt) hashes are crackable at scale with GPU clusters, particularly for predictable or default credentials. The blast radius extends to any system where the user reuses passwords, including web panels, email, and VPN access.

Affected Systems: All Proxmox VE deployments running qemu-server versions 8.0.0–8.4.7 and 9.0.0–9.1.7 are exposed. Multi-tenant hosting providers, MSPs managing multiple client environments, and enterprises with delegated API access are most susceptible because they naturally have low-privileged users interacting with the API. A single-tenancy root-only environment is less exposed but still vulnerable if API tokens are shared or compromised.

EPSS Consideration: The Exploit Prediction Scoring System (EPSS) score is 0.00201 (10.1st percentile), indicating a low observed exploitation probability in the wild. However, this is likely due to the novelty of the CVE (fictional 2026 identifier) — the technical ease of exploitation is high, and as soon as this write-up or a public PoC circulates, the EPSS will climb. Organizations should not treat "low EPSS" as "low risk."

Detection Guidance

The following detection rules assume Proxmox VE access logs (syslog) and HTTP API access logs are forwarded to a centralized SIEM. Proxmox logs API requests to /var/log/pve/access.log by default.

Sigma Rule

title: Proxmox VE Cloudinit Dump API Abuse
id: 8e1b6d5f-4a2c-4e9b-9d1a-2c8f3b7a5e01
status: experimental
description: Detects repeated or anomalous requests to the Proxmox VE cloudinit/dump API endpoint by low-privileged users, indicating potential exploitation of CVE-2026-51083.
logsource:
    product: proxmox
    service: access
detection:
    selection:
        request_method: GET
        request_path|contains|all:
            - '/api2/json/nodes/'
            - '/qemu/'
            - '/cloudinit/dump'
    filter_known_good:
        user_role: 'Administrator'
    condition: selection and not filter_known_good
    timeframe: 5m
level: high
falsepositives:
    - Legitimate administrators dumping cloud-init config for troubleshooting
fields:
    - clientip
    - username
    - request

YARA Rule

rule Proxmox_CVE_2026_51083_Cloudinit_Dump
{
    meta:
        author = "Valters IT Security"
        description = "Detects log entries indicating repeated cloudinit dump API requests"
        date = "2026-08-15"
        cve = "CVE-2026-51083"
    strings:
        $s1 = "/cloudinit/dump" ascii wide
        $s2 = "GET /api2/json/nodes/" ascii wide
        $s3 = "/qemu/" ascii wide
        $s4 = "200 OK" ascii wide
        $s5 = "PVE:PVE" ascii wide  // default Proxmox user realm marker
    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x0000A9) // PE or ELF
        and any of ($s1, $s2, $s3)
}

Note: The YARA rule is designed to scan log files or forensic disk images. It matches on the distinctive request path and success HTTP status. For live memory scanning, adjust to look for command-line arguments of curl or wget containing these strings.

Suricata IDS Rule

alert http any any -> any any (msg:"PROXMOX CVE-2026-51083 Cloudinit Dump API Exploitation Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/cloudinit/dump"; distance:0; http.request_line; pcre:"/\/api2\/json\/nodes\/[^\/]+\/qemu\/\d+\/cloudinit\/dump/"; metadata:cve CVE-2026-51083; reference:url,valtersit.com/cve-2026-51083; classtype:attempted-user; sid:511083; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [http where url.path like "*/qemu/*/cloudinit/dump" and http.request.method == "GET"]
  [http where url.path like "*/qemu/*/cloudinit/dump" and http.request.method == "GET"]

This EQL query matches on two or more distinct requests to the cloudinit/dump endpoint from the same user within five minutes, which is anomalous for a low-privileged user. To run in Elastic Security, map the url.path field from the Packetbeat or Winlogbeat HTTP module.

Splunk SPL Query

index=proxmox sourcetype=pve:access
| rex field=_raw "GET (?<uri>/api2/json/nodes/\S+/qemu/\d+/cloudinit/dump)"
| where isnotnull(uri)
| eval privilege_level=case(role=="Administrator","high", role=="PVEAdmin","high", role=="PVEVMUser","low", 1=1,"unknown")
| where privilege_level=="low" OR privilege_level=="unknown"
| stats count by username clientip uri
| where count > 5
| table _time username clientip count uri
| sort - count

Wazuh OSSEC Rule

<group name="proxmox, access-control,">
    <rule id="510830" level="12">
        <decoded_as>json</decoded_as>
        <field name="request">^/api2/json/nodes/.*/qemu/\d+/cloudinit/dump</field>
        <field name="method">GET</field>
        <description>Proxmox VE cloudinit/dump endpoint accessed - possible CVE-2026-51083 exploitation</description>
        <group>pve_vuln,</group>
        <mitre>
            <id>T1530</id>
        </mitre>
        <options>no_full_log</options>
    </rule>
</group>

Configure Wazuh to parse the Proxmox access log (json format). This rule triggers when any request matches the vulnerable endpoint, regardless of HTTP status.

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source.

Despite this assessment, the NVD description explicitly states affected versions are "before 9.1.8" and "before 8.4.8," which implies patched versions do exist. The Patch Confidence score of 0/4 indicates a lack of corroborating evidence from automated tracking sources, not that the patch is absent. Treat the following as actionable guidance.

1. Immediate Mitigations (before patching):

   • Restrict API access by IP: In datacenter.cfg or per-node firewall, allow API access (port 8006) only from trusted management subnets. Never expose the API to the internet.
   • Review and revoke unnecessary API tokens and user accounts. Audit all users with PVEVMUser or PVEDatastoreUser roles — these are the most likely to be affected by the IDOR.
   • Enable Two-Factor Authentication (2FA) for all PVE users to reduce the impact of a cracked password.
   • Monitor logs for unusual cloudinit/dump requests using the detection rules above.

2. Patch/Upgrade Steps:

   • Upgrade qemu-server to version 8.4.8 (for PVE 8.x) or 9.1.8 (for PVE 9.x). Use the standard Proxmox update procedure:

     apt update && apt install pve-qemu-server
     

     Alternatively, upgrade the entire PVE installation:

     apt update && apt full-upgrade
     

   • After upgrading, reboot each node in a rolling fashion to apply the kernel and service changes.
   • Verify the fix by attempting to access the cloudinit/dump endpoint for a VM you do not own — the request should now return a 401 Unauthorized or similar permission error.

3. Long-Term Hardening:

   • Follow the principle of least privilege: assign users minimal roles (PVEVMUser grants VM.Audit only on assigned VMs; avoid granting VM.Console or VM.Audit globally).
   • Regularly rotate cloud-init passwords and avoid using passwords in cloud-init altogether — prefer SSH key injection.
   • Use Proxmox's built-in role-based access control (RBAC) to create custom roles with explicit deny rules for the cloudinit/dump endpoint if such granular controls are supported.
   • Implement network segmentation separating the Proxmox management network from guest VM traffic.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-51083 — Official NVD record with CVSS score and description.
2. Proxmox VE Security Advisories: https://pve.proxmox.com/wiki/Security_Advisories — Vendor advisory page; check for an advisory referencing qemu-server 9.1.8 and 8.4.8.
3. Proxmox Bug Tracker: https://bugzilla.proxmox.com/ — Search for issue IDs related to cloudinit/dump authorization bypass.

Threat Actor Campaigns: As of this writing (2026-08-15), there are no confirmed reports of this CVE being exploited in the wild, and it is not present on the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score of 0.00201 corroborates low observed exploitation. However, given the ease of the attack (a simple GET request) and the high value of the data (password hashes), we anticipate that proof-of-concept scripts will appear in the coming weeks. Monitor underground forums and GitHub for any PoC referencing the endpoint pattern /cloudinit/dump.