CVE-2023-54391 in Proxmox Virtual Environment
Summary
by MITRE • 09/02/2026
Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value in the API login endpoint. Attackers can send a POST request to the access ticket API endpoint with any value in the tfa-challenge parameter to completely skip password verification, gaining unauthorized access including to the root@pam account. All affected releases are end of life.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified within Proxmox Virtual Environment versions 7.0 through 8.0 represents a critical authentication bypass flaw located in the libpve-access-control component prior to version 8.0.4. This security defect fundamentally undermines the integrity of the multi-factor authentication (MFA) mechanism implemented by the platform. Specifically, the vulnerability allows unauthenticated attackers to authenticate as any existing enabled user without requiring a configured second factor. The root cause lies in the API login endpoint's handling of the tfa-challenge parameter during the ticket generation process. By supplying an arbitrary value for this parameter within a POST request to the access ticket API endpoint, an attacker can bypass the verification logic that is supposed to validate the secondary authentication step. This flaw effectively neutralizes one of the primary layers of defense in Proxmox VE's security architecture, allowing unauthorized entities to gain full administrative control over the virtualization environment.
From a technical perspective, this vulnerability aligns with CWE-287, which describes Improper Authentication, and more specifically CWE-306, Missing Authentication for Critical Function. The attack vector is classified under MITRE ATT&CK technique T1078, Valid Accounts, as it involves the misuse of legitimate credentials or authentication mechanisms to gain unauthorized access. Furthermore, because the flaw allows an attacker to bypass MFA entirely and assume any user identity, including the highly privileged root@pam account, it also relates to CWE-250, Execution with Unnecessary Privileges. The exploitation does not require complex payload construction; rather, it relies on a simple manipulation of HTTP request parameters sent to the API endpoint. This simplicity makes the vulnerability particularly dangerous in automated attack scenarios where threat actors can rapidly scan for and exploit this misconfiguration across multiple instances.
The operational impact of this vulnerability is severe due to the critical nature of virtualization management platforms. Proxmox VE serves as a hypervisor manager, controlling access to virtual machines, storage configurations, network settings, and host system resources. An attacker who successfully exploits this flaw can gain complete control over the underlying infrastructure. This includes the ability to create, modify, or delete virtual machines; exfiltrate sensitive data stored within those VMs; install persistent backdoors on the hypervisor itself; and potentially pivot into other networks connected via the proxmox management interface. The fact that all affected releases are end of life exacerbates the risk significantly. Organizations running these versions lack access to official security patches, leaving them exposed indefinitely unless they migrate to supported versions or implement compensating controls such as network segmentation, strict firewall rules restricting API access, and additional web application firewalls capable of detecting anomalous authentication patterns.
Mitigation strategies must prioritize immediate remediation through version upgrades where possible. Administrators should upgrade libpve-access-control to version 8.0.4 or later, which addresses the flawed logic in the tfa-challenge parameter handling. For environments that cannot immediately upgrade due to compatibility constraints with end-of-life software, strict network-level controls are essential. Access to the Proxmox API endpoint should be restricted to trusted IP ranges using firewall rules or reverse proxy configurations. Additionally, implementing rate limiting and anomaly detection on authentication endpoints can help mitigate automated exploitation attempts. Security teams must also audit existing user accounts for any signs of unauthorized activity, as past exploits may have already resulted in persistent compromise given the lack of patch availability for these specific versions.