What is the CVSS score of EUVD-2026-45183?

EUVD-2026-45183 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Proxmox VE EUVD-2026-45183

| CVE-2026-51083 MEDIUM

Improper Access Control (CWE-284)

2026-07-17 mitre

GHSA-3q5r-q6qf-qq6p

Authentication Bypass N A

6.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible REST API requires low-privilege authentication; confidentiality impact is high as hashed passwords enable offline credential recovery; no integrity or availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 17:20 vuln.today

CVSS changed

Jul 17, 2026 - 16:22 NVD

6.5 (MEDIUM)

CVE Published

Jul 17, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Incorrect access control in Proxmox Virtual Environment (PVE) 9.x qemu-server before 9.1.8 and 8.x before 8.4.8 allows users within limited privileges to obtain hashed passwords via the cloudinit/dump API.

AnalysisAI

Incorrect access control in the Proxmox Virtual Environment qemu-server component exposes hashed passwords to authenticated low-privilege users via the cloudinit/dump API endpoint. Affects PVE 8.x before 8.4.8 and 9.x before 9.1.8. An attacker with minimal PVE credentials can retrieve cloud-init password hashes for VMs, enabling offline cracking and potential lateral movement into guest systems. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.

Technical ContextAI

Proxmox Virtual Environment's qemu-server package manages QEMU/KVM virtual machines. The cloud-init subsystem is used to inject configuration data - including user credentials - into VMs at boot time. The cloudinit/dump API exposes this configuration, and the flaw (CWE-284, Improper Access Control) means authorization checks on this endpoint fail to restrict access to sufficiently privileged users. Low-privilege users who should only manage their own VMs or have read-only roles can query the dump endpoint for other VMs, obtaining the hashed credential material embedded in the cloud-init config. The CPE data provided is non-specific (n/a), but the description clearly identifies cpe:2.3:a:proxmox:qemu-server as the affected component across the 8.x and 9.x release trains.

RemediationAI

The primary fix is to upgrade Proxmox VE qemu-server to version 9.1.8 or later on the 9.x branch, or to version 8.4.8 or later on the 8.x branch, as documented in the Proxmox security advisory thread at https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/page-2#post-84997. If immediate patching is not possible, restrict API access to the PVE management interface at the network level so that only trusted, explicitly authorized accounts can reach the API - this limits the blast radius of low-privilege accounts. Additionally, audit current PVE user roles and remove unnecessary 'VM.Audit' or related permissions from accounts that do not require them, reducing the pool of users who can invoke the cloudinit/dump endpoint. Note that restricting network access to the PVE API may impact legitimate administrative workflows and remote management tooling. Rotating cloud-init passwords for sensitive VMs after patching is advisable to mitigate any hashes that may have already been exfiltrated.