Critical Authentication Bypass in Proxmox Virtual Environment 7.x and 8.0 (CVE-2023-54391) – 20260902007

/ Advisory, News & Events / By
SeverityCRITICAL
Threat CategoryVulnerability – Authentication Bypass (CWE-304)
Affected PlatformsProxmox Virtual Environment 7.0 – 7.4 and 8.0 with libpve-access-control 7.0-7 through 8.0.3 (all versions before 8.0.4)
CVE(CVE-23-54391)
CVSS9.8 CRITICAL (v3.1) / 9.3 CRITICAL (v4.0)

1. Overview

Proxmox Server Solutions has published an advisory for a critical authentication bypass in Proxmox Virtual Environment (VE), the widely used open-source virtualisation platform. The flaw, now tracked as CVE-2023-54391, allows an unauthenticated attacker with network access to the Proxmox VE API or web interface to log in as any existing, enabled user that has no second factor configured. By default this includes the root@pam superuser account.

The bug was silently fixed in July 2023 in libpve-access-control 8.0.4, but was only recognised as a security issue and assigned a CVE on 1st September 2026. All affected releases (Proxmox VE 7.0 through 7.4, and the initial 8.0 release before updates) are end of life. Systems that were never updated past mid-2023 remain fully exploitable today.

2. Who is Affected

Any organisation running Proxmox VE 7.x, or Proxmox VE 8.0 that has not received package updates since July 2023, is affected. Proxmox VE is commonly deployed in government data centres, universities, ISPs, small and medium enterprises, and home labs in Bhutan as a low-cost alternative to commercial hypervisors. A single compromised Proxmox host gives an attacker control over every virtual machine and container it runs.

BtCIRT has not received any reports of confirmed exploitation within Bhutan at the time of publication. The severity is nonetheless assessed as CRITICAL for the following reasons:

  • Exploitation requires no credentials, no user interaction, and no special conditions. A single crafted HTTP request is sufficient.
  • The default administrator account root@pam is vulnerable unless two-factor authentication has been explicitly enabled on it.
  • VulnCheck lists the flaw in its Known Exploited Vulnerabilities catalogue, and public technical details are now available, which makes broad opportunistic scanning likely.
  • Affected versions are the end of life. Organisations that have deferred upgrading from Proxmox VE 7 receive no further vendor updates and are exposed indefinitely unless they act

3. How the [Threat/Vulnerability/Attack] Works

  1. Root Cause

In libpve-access-control (7.0-7 to 8.0.3), Proxmox skips password verification when a tfa-challenge parameter is present without validating its signature for accounts lacking 2FA (CWE-304).

  1. Exploitation

An unauthenticated attacker can log in as any 2FA-disabled account (e.g., root@pam) simply by sending a login request containing an arbitrary tfa-challenge value to bypass password checks.

  1. Impact

With a valid ticket for root@pam, the attacker yields full administrative control over the node or cluster. Attackers can access VM consoles, tamper with disk images/backups, exfiltrate data, plant ransomware, or run unauthorized workloads.

  1. Fix & Disclosure

Patched in libpve-access-control 8.0.4 (July 2023). Following 2026 reports by Kamil Rakowski, Nathan Xavier Golez, and Sagnik Sasmal, it was assigned CVE-2023-54391 and published under advisory PSA-2026-00043-1 (Sept 1, 2026).

4. Indicators to Watch For

  • The installed access-control package is older than 8.0.4. Check with: dpkg-query -W -f ‘${Version}\n’ libpve-access-control
  • The host reports Proxmox VE 7.x, or 8.0 without updates. Check with: pveversion
  • Successful logins for root@pam or other privileged users in /var/log/pveproxy/access.log or the journal (pvedaemon) from unexpected source IP addresses, especially where no failed password attempts precede them.
  • POST requests to /api2/json/access/ticket containing a tfa-challenge parameter for accounts that do not have two-factor authentication configured.
  • Newly created users, API tokens, SSH keys, or virtual machines that were not provisioned by your administrators, and unexplained changes to backup jobs or storage configuration.
  • The Proxmox web interface (TCP port 8006) is exposed directly to the Internet. Any such host running an affected version should be treated as compromised until verified.

5. Recommendations

5.1. For organizations and government offices

  • Upgrade immediately. Proxmox VE 7 reached end-of-life in 2024, and no longer receives security updates, bug fixes, or official support. Follow the official upgrade path to Proxmox VE 8 (and then 9 where supported) so that libpve-access-control 8.0.4 or later is installed. On 8.0 hosts, running a standard apt update and dist-upgrade is sufficient.
  • If an upgrade cannot be completed at once, apply the interim patch script published in Proxmox advisory PSA-2026-00043-1, which adds validation of the tfa-challenge parameter, and schedule the full upgrade as a priority.
  • Remove the Proxmox web interface and API (port 8006) from direct Internet exposure. Restrict access to a management VLAN or require a VPN.
  • Enable two-factor authentication (TOTP, WebAuthn or YubiKey) for root@pam and every other privileged account. Accounts with a configured second factor are not affected by this bypass.
  • Review authentication and API logs going back to at least July 2023 for the indicators in Section 4. If unexplained privileged logins are found, treat the host and its guests as compromised: rotate all credentials and API tokens, audit VM and storage configuration, and restore from known-good backups.
  • Ensure hypervisor backups are stored off the affected host and are not writable using the Proxmox node credentials, so a compromised node cannot destroy its own backups.

6. Reporting

If you suspect your organization, device or account has been affected by this threat, or observe activity matching this pattern, please report it to BtCIRT at cirt@btcirt.bt

7. Sources and References

  1. Proxmox Security Advisory PSA-2026-00043-1 – Authentication bypass in EOL Proxmox VE 7 release (1 September 2026).
    https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/page-4#post-867929
  2. CVE-2023-54391 – CVE Record (VulnCheck CNA) (1 September 2026).
    https://www.cve.org/CVERecord?id=CVE-2023-54391
  3. VulnCheck Advisory – Proxmox VE 7.0–8.0 Authentication Bypass via tfa-challenge Parameter (1 September 2026).
    https://www.vulncheck.com/advisories/proxmox-ve-authentication-bypass-via-tfa-challenge-parameter
  4. Proxmox pve-access-control fix commit 032e7d6d – “auth: tfa: fail if realm requires TFA but no challenge is generated” (19 July 2023).
    https://git.proxmox.com/?p=pve-access-control.git;a=commit;h=032e7d6d441f89a48cadfd7f47e957c8a561c022
  5. NVD – CVE-2023-54391 Detail (1 September 2026).
    https://nvd.nist.gov/vuln/detail/CVE-2023-54391

Scroll to Top