CVE-2023-54391: Proxmox VE Authentication Bypass Vulnerability

CVE-2023-54391 Overview

CVE-2023-54391 is an authentication bypass vulnerability in Proxmox Virtual Environment (VE) affecting libpve-access-control before version 8.0.4. The flaw resides in the API login endpoint, where supplying an arbitrary tfa-challenge value causes the server to skip password verification entirely. Unauthenticated attackers can authenticate as any enabled user, including the root@pam administrative account, by sending a crafted POST request to the access ticket endpoint. Proxmox VE versions 7.0 through 8.0 are affected, and all impacted releases are end of life. The weakness is classified as [CWE-304]: Missing Critical Step in Authentication.

Critical Impact
Unauthenticated remote attackers can obtain full administrative access to Proxmox VE hosts, enabling control of every virtual machine and container managed by the hypervisor.

Affected Products

Proxmox Virtual Environment 7.0 through 7.x
Proxmox Virtual Environment 8.0
libpve-access-control versions prior to 8.0.4

Discovery Timeline

2026-09-01 - CVE-2023-54391 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2023-54391

Vulnerability Analysis

Proxmox VE exposes an access ticket API endpoint that issues authentication tokens after validating user credentials and, optionally, a second factor. The login handler in libpve-access-control accepts a tfa-challenge parameter used to complete two-factor authentication (TFA) flows. When this parameter is present in the request, the code path treats the request as a follow-up to an already-authenticated first step and bypasses password verification. Attackers exploit this logic gap by placing any arbitrary string in tfa-challenge on the initial request, causing the server to issue a valid session ticket for the specified username. The result is complete authentication bypass against users that do not have a configured second factor, including administrative accounts.

Root Cause

The root cause is a missing critical step in the authentication state machine [CWE-304]. The login handler conflates the presence of a tfa-challenge value with successful prior credential validation. No server-side state is checked to confirm that the password stage actually completed, and no cryptographic binding ties the challenge value to a prior authenticated session. The upstream fix in commit 032e7d6d441f89a48cadfd7f47e957c8a561c022 corrects the control flow so that password verification is enforced before any TFA challenge is honored.

Attack Vector

Exploitation is network-based and requires no authentication, no user interaction, and low attack complexity. An attacker sends a POST request to the Proxmox VE access ticket API endpoint, supplying a valid username such as root@pam, an arbitrary password, and any string as the tfa-challenge parameter. The server returns a valid authentication ticket and CSRF token that grant full API access. From there, adversaries can create VMs, exfiltrate disk images, deploy malicious containers, or pivot into the hypervisor host. See the VulnCheck Proxmox Authentication Advisory for the exploitation request structure.

Detection Methods for CVE-2023-54391

Indicators of Compromise

POST requests to /api2/json/access/ticket or /api2/extjs/access/ticket that include a tfa-challenge parameter but lack a preceding successful password authentication event.
Successful ticket issuance for root@pam or other privileged users from unexpected source IP addresses or geolocations.
New API tokens, users, or SSH keys created shortly after anomalous ticket API calls.
Unexpected VM, container, or storage operations initiated through the Proxmox API.

Detection Strategies

Parse Proxmox pveproxy access logs for /access/ticket requests carrying tfa-challenge values, and correlate with the absence of prior failed or successful password submissions from the same client.
Alert on authentication success events for root@pam originating from IPs outside a defined administrative allowlist.
Baseline API call patterns per user and flag deviations such as bulk VM enumeration immediately after ticket issuance.

Monitoring Recommendations

Forward pveproxy and pvedaemon logs to a central SIEM or data lake for long-term retention and correlation.
Monitor egress traffic from Proxmox hosts for outbound connections to unfamiliar IPs, indicating possible attacker persistence.
Enable audit logging on virtual machine lifecycle operations and cluster configuration changes.

How to Mitigate CVE-2023-54391

Immediate Actions Required

Upgrade libpve-access-control to version 8.0.4 or later on all Proxmox VE nodes and cluster members.
Restrict access to the Proxmox web interface and API (default TCP port 8006) to trusted management networks using firewall rules or a VPN.
Rotate credentials for root@pam and any privileged Proxmox accounts, and invalidate existing API tokens.
Audit recent login events and configuration changes for signs of unauthorized activity.

Patch Information

The upstream fix is available in the pve-access-control repository under commit 032e7d6d441f89a48cadfd7f47e957c8a561c022. Refer to the Proxmox Commit Log Update for source-level details and the Proxmox Security Advisory Forum for release guidance. Because Proxmox VE 7.x and 8.0 are end of life, administrators should upgrade to a supported Proxmox VE release that ships the patched package.

Workarounds

Enforce two-factor authentication for every enabled user account, because the bypass only succeeds against users without a configured second factor.
Place the Proxmox management interface behind an authenticating reverse proxy or bastion host that requires mutual TLS.
Disable or lock unused local and PAM accounts, especially interactive root@pam login, and use dedicated non-root API users where possible.

bash

# Upgrade the affected package on Debian-based Proxmox nodes
apt update
apt install --only-upgrade libpve-access-control
dpkg -l libpve-access-control | grep ^ii

# Restrict API access to a management subnet using pve-firewall
# /etc/pve/firewall/cluster.fw
# [RULES]
# IN DROP -p tcp -dport 8006 -source !10.10.0.0/24 -log warning