The flaw is an incorrect access control in Proxmox Virtual Environment qemu-server versions 9.x up to 9.1.7 and 8.x up to 8.4.7. A user with limited privileges can call the cloudinit/dump API endpoint and retrieve the hashed passwords stored for virtual machines. The exposed credentials could be cracked or reused to gain further access, creating a significant threat to confidentiality and potentially allowing an attacker to compromise other systems that rely on those passwords. The weakness is identified as CWE-284, an access control problem.

The vulnerability affects Proxmox Virtual Environment running qemu-server on 9.x prior to 9.1.8 and on 8.x prior to 8.4.8. Any installation of these releases that has API access enabled is at risk if users can authenticate to the API and have non-administrator privileges.

The CVSS score of 6.5 indicates medium severity, while the EPSS score is below 1%, implying a very low probability of exploitation at present. The flaw is not listed in CISA's KEV catalog. Exploitation requires an authenticated API session with limited privileges and direct use of the cloudinit/dump call; once achieved, the attacker can read hashed passwords but must still resolve those hashes to use them. The main impact is loss of credential confidentiality, which could serve as a stepping stone to additional attacks.