What is the CVSS score of CVE-2026-51083?

CVE-2026-51083 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Proxmox VE CVE-2026-51083

EUVD-2026-45183 MEDIUM

Improper Access Control (CWE-284)

2026-07-17 mitre

GHSA-3q5r-q6qf-qq6p

Authentication Bypass N A

6.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible REST API requires low-privilege authentication; confidentiality impact is high as hashed passwords enable offline credential recovery; no integrity or availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 17:20 vuln.today

CVSS changed

Jul 17, 2026 - 16:22 NVD

6.5 (MEDIUM)

CVE Published

Jul 17, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Incorrect access control in Proxmox Virtual Environment (PVE) 9.x qemu-server before 9.1.8 and 8.x before 8.4.8 allows users within limited privileges to obtain hashed passwords via the cloudinit/dump API.

AnalysisAI

Incorrect access control in the Proxmox Virtual Environment qemu-server component exposes hashed passwords to authenticated low-privilege users via the cloudinit/dump API endpoint. Affects PVE 8.x before 8.4.8 and 9.x before 9.1.8. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate to PVE API with low-privilege account

Delivery

Enumerate VMs accessible via cloudinit/dump endpoint

Exploit

Retrieve hashed cloud-init passwords for target VMs

Execution

Perform offline hash cracking

Impact

Authenticate to guest VM with recovered credentials

Access

Authenticate to PVE API with low-privilege account

Delivery

Enumerate VMs accessible via cloudinit/dump endpoint

Exploit

Retrieve hashed cloud-init passwords for target VMs

Execution

Perform offline hash cracking

Impact

Authenticate to guest VM with recovered credentials

Vulnerability AssessmentAI

Exploitation	Exploitation requires an authenticated PVE account with at least low-level privileges sufficient to call the cloudinit/dump API - PR:L in the CVSS vector confirms this. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) scores 6.5 Medium, accurately reflecting a network-accessible API exploit requiring only low-privilege authentication, with no user interaction or elevated complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker who has obtained low-privilege credentials to a shared Proxmox VE deployment - for example, a tenant in a hosting environment or a junior admin account - authenticates to the PVE REST API and issues a GET request to the cloudinit/dump endpoint for VMs they do not own. The response contains hashed passwords embedded in the cloud-init configuration. …
Remediation	The primary fix is to upgrade Proxmox VE qemu-server to version 9.1.8 or later on the 9.x branch, or to version 8.4.8 or later on the 8.x branch, as documented in the Proxmox security advisory thread at https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/page-2#post-84997. … Detailed patch versions, workarounds, and compensating controls in full report.