Executive brief
A security flaw in Proxmox Virtual Environment (PVE) allows a user with limited administrative permissions to hijack the remote console session of a different virtual machine. This occurs when two users attempt to access consoles at the same time, potentially allowing an attacker to view or control a server they are not authorized to access. This could lead to the exposure of sensitive data or unauthorized changes to critical business systems.
Technical details
A race condition exists between the 'vncproxy' and 'vncwebsocket' API calls in multiple Proxmox VE components, including pve-manager, qemu-server, and pve-container. An attacker who possesses the privileges required to initiate a 'vncproxy' call can exploit this timing window to intercept and hijack a VNC session being established simultaneously by a different legitimate user for a different VM or container. This allows for unauthorized access to the guest console. The issue is resolved in pve-manager 9.1.9/8.4.19, qemu-server 9.1.7/8.4.7, and pve-container 6.1.3/5.3.4.
Affected products
- Proxmox pve-manager 9.1.x before 9.1.9, 8.4.x before 8.4.19
- Proxmox qemu-server 9.1.x before 9.1.7, 8.4.x before 8.4.7
- Proxmox pve-container 6.1.x before 6.1.3, 5.3.x before 5.3.4
Timeline
- 2026-07-17: disclosed
- 2026-07-17: advisory