A Three-Year-Old Proxmox Fix Just Became an Emergency

CVE-2023-54391 affects Proxmox VE 7.0 through 7.4 and the initial 8.0 release through libpve-access-control versions before 8.0.4. An unauthenticated attacker who can reach the login API can skip the normal password check for an existing enabled account by supplying an arbitrary tfa-challenge value.

The second-factor parameter skipped the first factor

The affected access-ticket code accepted a request containing tfa-challenge as though password authentication had already succeeded. Instead of proving possession of the account password, the attacker could move directly into the two-factor branch.

The most dangerous target is root@pam. Where an enabled account does not have a second factor configured, the crafted request can produce an authenticated session without either a valid password or a completed MFA challenge. Successful access to an administrative account exposes the Proxmox control plane rather than one guest system.

The fix predates the disclosure by three years

A July 2023 refactor removed the vulnerable logic in libpve-access-control 8.0.4. Proxmox says the change was not understood as a security fix at the time, so it was not backported to the Proxmox VE 7 branch.

The security implications were formally documented in advisory PSA-2026-00043-1 on 1 September 2026. By then, every affected release was end of life. That leaves no supported patch destination within the vulnerable branches. Administrators need to move to a current release, not wait for an update to appear on an obsolete system.

Reports of exploitation need careful labels

Public discussions connected the disclosure with compromised and encrypted Proxmox hosts, and a reproducible request pattern is now available. Those signals justify urgent exposure checks, but they do not prove that every reported incident used this vulnerability.

Proxmox has not confirmed exploitation in the wild. CISA’s current vulnerability enrichment marks exploitation as none, and CVE-2023-54391 is not in CISA’s Known Exploited Vulnerabilities catalogue. There is therefore no federal 5 September remediation deadline for this CVE. Public exploitability and confirmed campaign use are different claims.

Why the hypervisor makes the impact severe

The Proxmox interface controls virtual machines, containers, storage, backups, networking and cluster membership. An administrative session can expose guest consoles and disks, alter backups, create new workloads or destroy the systems that depend on the host.

An internet-facing management service also gives an attacker a reliable place from which to pivot. Even where the exploit lands only in the web control plane, the permissions behind that interface can reach nearly every workload the organisation placed on the cluster.

What defenders should do now

• Remove affected Proxmox management interfaces from the public internet immediately.
• Migrate Proxmox VE 7 and the initial 8.0 release to a currently supported release with all security updates installed.
• Review access-ticket requests for unexpected tfa-challenge parameters, successful sessions without corresponding password validation and access involving root@pam.
• Audit new users, API tokens, virtual machines, storage changes, backup jobs and cluster configuration changes.
• Rotate administrative credentials and integration secrets if the management interface was reachable while vulnerable.
• Preserve authentication, proxy and host logs before rebuilding any server with unexplained encryption, deleted logs or unauthorised configuration changes.

The bigger lesson

A fix can exist without a security advisory, and unsupported software can remain vulnerable even when newer code is safe. Asset owners cannot use the absence of an available update as evidence that an end-of-life control plane has no urgent security problem.

Sources: Proxmox advisory PSA-2026-00043-1, GitHub Advisory Database, the Proxmox patch commit, and CISA’s KEV data repository.