Summary
CVE-2026-51083 is an authentication bypass flaw in Proxmox Virtual Environment that allows low-privilege users to access hashed passwords through the cloudinit/dump API endpoint. The vulnerability resides in the qemu-server package and exposes credential material that should be restricted to administrative roles.
Affected Asset
Proxmox Virtual Environment (PVE) 8.x with qemu-server before 8.4.8 and 9.x with qemu-server before 9.1.8; homelab deployments using cloud-init for VM provisioning.
Affected Endpoint
/api2/json/nodes/{node}/qemu/{vmid}/cloudinit/dump API endpoint
Prerequisites
Host running Proxmox VE 8.x before 8.4.8 or 9.x before 9.1.8; VM configured with cloud-init; attacker has a limited-privilege user account (e.g., VM.Audit role) on the target VM.
Steps to Reproduce
1. Obtain a limited-privilege user token on a Proxmox VE cluster (e.g., VM.Audit or equivalent restricted role). 2. Send an HTTP request to the cloudinit/dump API endpoint for a target VM: GET /api2/json/nodes/{node}/qemu/{vmid}/cloudinit/dump. 3. Parse the response to retrieve hashed password entries from the rendered cloud-init user-data document. 4. Perform offline credential cracking against the recovered hashes.
Evidence
Proxmox Security Advisory Forum (forum.proxmox.com threads on security advisories); NVD CVE-2026-51083 entry; OpenCVE entry confirming CVSS 6.5 and access control gap.
Impact
Attacker can perform offline cracking of VM password hashes, enabling lateral movement to guest operating systems or credential reuse against other services. In homelab environments, this may expose credentials stored in cloud-init configurations for personal VMs.
Root Cause
The defect is an authorization gap in the API handler for cloudinit/dump. The endpoint returns the full rendered cloud-init user-data document without stripping sensitive fields or validating that the caller holds a role authorized to view credentials. Permission checks confirm access to the VM object but do not scope which fields the response may include.
Remediation
Upgrade qemu-server to version 9.1.8 on Proxmox VE 9.x or version 8.4.8 on Proxmox VE 8.x. On each Proxmox node: apt update && apt install --only-upgrade qemu-server. After updating, rotate any passwords provisioned to VMs through cloud-init on affected clusters, assuming the hashes may have been retrieved.
Verification Steps
Run runc --version on each Proxmox node to confirm the updated qemu-server package is installed. Verify installed version meets the fixed release: dpkg -l qemu-server | awk '/qemu-server/ {print $3}'. Run a test by issuing a cloudinit/dump API request from a limited-privilege user token and confirm no hashed password entries appear in the response.