CVE-2023-54391

Proxmox Virtual Environment (VE) 7.0 through 8.0 contains a critical authentication bypass (CWE-304) in the libpve-access-control package before 8.0.4. An unauthenticated attacker can send a POST request to the access/ticket API login endpoint and supply any value in the tfa-challenge parameter, which causes password verification to be skipped entirely for any existing enabled user that does not have a second factor configured. This grants full access as that account, including the root@pam superuser, effectively compromising the hypervisor and, by extension, the virtual machines and containers it manages. All affected Proxmox VE releases (7.0 through 8.0) are end of life, so systems that have not moved to a supported release remain exposed. No public proof of concept is known, the flaw is not in CISA's KEV, and EPSS currently estimates a 1.7% probability of exploitation within 30 days.

What to do: Upgrade to a currently supported Proxmox VE release that ships libpve-access-control 8.0.4 or later, since all affected versions (7.0 through 8.0) are end of life and will not receive this fix. Until patched, restrict access to the Proxmox web UI/API (default TCP port 8006) to trusted networks only and review authentication logs for successful logins that occurred without a valid password or second factor. Confirm which accounts lack a configured second factor, because those accounts are the ones fully exposed to this bypass.