Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2023-54391 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2023 |
| Date Published | 2026-09-02 |
| Vendor | Proxmox |
| Product | Virtual Environment |
| CVSS Score | 9.8 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
Proxmox Virtual Environment 7.0 through 8.0 contains an authentication bypass in the libpve-access-control component before version 8.0.4.
An attacker sends a POST request to the access ticket API endpoint (/api2/json/access/ticket) carrying an arbitrary value in the tfa-challenge parameter. The server then skips password verification entirely and issues a valid ticket for the named account. The prerequisite is that the account is enabled and has no second authentication factor configured - the default state for most accounts in a typical deployment.
The result is full takeover of the virtualisation management plane without knowing any password. If the attacker targets root@pam, they gain control of the hypervisor host, every virtual machine and container, and the attached storage.
Counter-intuitively, enabled 2FA is what protects here - accounts with a second factor are not affected. Deployments that never rolled out MFA are exposed across the board.
Required Actions
- Upgrade
libpve-access-controlto 8.0.4 or later (apt update && apt dist-upgradefrom the Proxmox repository), then restartpveproxyandpvedaemon. - Remove the management interface (port 8006) from the internet. The Proxmox panel should not be publicly exposed - access via VPN or a dedicated management network only.
- Enable 2FA on all accounts, starting with
root@pamand other administrative accounts. Beyond this specific flaw, it is baseline protection for a hypervisor console. - Invalidate active sessions and tickets after upgrading - a ticket obtained through exploitation stays valid until it expires.
- Review authentication logs (
/var/log/pveproxy/access.log,journalctl -u pvedaemon) for/access/ticketrequests carryingtfa-challengefrom unknown addresses. - Audit users, permissions and host cron/hook entries - control of the panel allows an attacker to plant persistent access.
Who Is Affected?
All Proxmox VE 7.0 - 8.0 deployments with libpve-access-control older than 8.0.4, where enabled accounts exist without a configured second factor.
Proxmox is widely deployed as a VMware alternative - especially after Broadcom’s licensing changes. It appears at hosting providers, in manufacturing companies, local government units and mid-sized enterprise IT departments, often hosting business-critical systems.
Risk is highest where port 8006 is reachable from outside the internal network, or where the same Proxmox cluster serves both production and backup workloads.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
