CVE-2023-54391
Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value in the API login endpoint. Attackers can send a POST request to the access ticket API endpoint with any value in the tfa-challenge parameter to completely skip password verification, gaining unauthorized access including to the root@pam account. All affected releases are end of life.
Early warning: exploitation observed
- Exploitation observed since Sep 1, 2026
- Not yet in the official CISA catalogue
- Attacked 1 day before the vulnerability was made public
- Confirmed by sensors, not only by reports
- Used in ransomware campaigns
Source: VulnCheck KEV · Sep 21, 2026 Sep 20, 2026 Sep 7, 2026 Sep 2, 2026 Sep 2, 2026 Sep 1, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HRelated articles
This product uses the NVD API but is not endorsed or certified by the NVD.