Proxmox VNC Session Hijacking via Race Condition

A race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment (PVE) 9.x pve-manager before 9.1.9 and 8.x before 8.4.19; qemu-server 9.x before 9.1.7 and 8.x before 8.4.7; and pve-container before 6.1.3 (PVE 9.x) and before 5.3.4 (PVE 8.x) allows an attacker with privileges to call "vncproxy" to hijack a VNC session that is established in parallel by a different user for a different VM.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-51082 exploits a race condition vulnerability in Proxmox Virtual Environment's VNC proxy implementation, affecting versions 9.x before 9.1.9 and 8.x before 8.4.19. The flaw exists in the vncproxy and vncwebsocket API calls, allowing an attacker with valid privileges to intercept and hijack VNC sessions established by other users for different virtual machines. This is particularly critical because it enables lateral privilege escalation and unauthorized access to isolated VM environments—a core security boundary in virtualized infrastructure. Organizations running affected Proxmox versions face exposure of sensitive console access, potential VM compromise, and violation of multi-tenancy isolation guarantees.

Casky's 224 matching skills leverage Claude AI with extended reasoning to detect the attack patterns associated with TA0004 (Privilege Escalation) techniques underlying this CVE. Practitioners using Casky would identify suspicious indicators including: concurrent API calls to vncproxy and vncwebsocket from the same source IP or user account in abnormal timing patterns, unexpected VNC session establishments for VMs outside a user's normal access scope, and authentication logs showing successful console access immediately following failed or rapid API requests. By mapping these behavioral patterns to the race condition mechanics and CWE-362 (concurrent execution), the platform flags attempts at session hijacking that traditional signature-based tools might miss, enabling security teams to detect exploitation before VM isolation is breached.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-51082.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

penetration testing · medium

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-51082

Casky has 224 skills that investigate the attack patterns behind CVE-2026-51082. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn