A three-year-old bug in Proxmox VE, the open-source virtualization platform popular with small hosts and home labs, lets anyone who can reach its management API log in as root with no password. Proxmox says it is being exploited in the wild. The fix shipped in July 2023, but only for version 8, so every Proxmox VE 7 host still on the internet is exposed and will never get a package update.
The bug is a login that forgets to check the password.
Proxmox published advisory PSA-2026-00043-1 on Tuesday 1 September after "many independent reports within the last two days, which also report exploitation in the wild." The same evening VulnCheck, as numbering authority, assigned it CVE-2023-54391 and scored it 9.8 on CVSS 3.1 and 9.3 on CVSS 4.0; the NVD record carries those scores but NVD has not yet analysed it.
One bogus parameter skips the password check
The API login call accepts a parameter called tfa-challenge. Normally it carries the signed ticket a two-factor user receives after entering a password. In the affected versions, Proxmox says, the parameter "was not validated for users without configured second factors, while its presence also caused the verification of the submitted password to be skipped entirely."
An attacker who can reach the API port, 8006, directly or through a reverse proxy, "could authenticate as any existing, enabled user without configured second factors (by default this includes root@pam), without knowing any credentials, by passing an arbitrary value in the tfa-challenge parameter." The root@pam account is the platform's built-in superuser.
Affected is the libpve-access-control package from 7.0-7 up to but not including 8.0.4, roughly Proxmox VE 7.0 through 7.4, end of life since July 2024, plus the first 8.0 installs before the fix landed a month later. Check the installed package version, not the overall VE version, with dpkg-query -W -f '${Version}\n' libpve-access-control.
The fix existed for three years, and nobody knew it was one
The vulnerable code path was closed in July 2023 with libpve-access-control 8.0.4 "as a side effect of a rework of the TFA configuration handling for an unrelated issue." Nobody had found the bypass, so the rework was never backported to the 7 branch. It surfaced this week, independently reported by Kamil Rakowski, Nathan Xavier Golez and Sagnik Sasmal, and, the advisory adds, by "various LLMs."
Ransomware reports on the forum, none of them confirmed
The pressure behind the advisory is visible in a user thread opened on 31 August, a day before Proxmox spoke. Its author wrote that a four-year-old, internet-exposed Proxmox VE 7 host with a single root user "was encrypted, and a ransom was demanded for decryption." Others relayed second-hand reports of compromised 8.x hosts, which the advisory's version range does not support. No ransomware family or actor is named anywhere, so treat that link as reported, not established. A public proof of concept appeared on GitHub about two hours after the advisory; CISA's early triage on 2 September recorded exploitation as "none", and the CVE was not in its Known Exploited Vulnerabilities catalog as of 4 September.
One root shell on a hypervisor owns every guest on the box, which is why July's VMware vCenter authentication bypass and a KVM guest-to-host escape drew such attention. Proxmox runs on KVM.
Upgrade, or apply the stop-gap and close port 8006
Proxmox says upgrading to a supported release "is the only durable fix," since the affected releases have missed every security fix since they went end of life. For hosts that cannot upgrade immediately, the advisory supplies a one-line sed patch that adds a ticket-verification step to the access-control module, followed by a restart of pvedaemon and pveproxy, after which every tfa-challenge value must be a valid signed ticket. Two mitigations help regardless: restrict the API port to trusted networks, which Proxmox notes "has always been our recommended setup," and configure a second factor for every login user, because users with any second factor are not affected.
A bug nobody knew they had fixed is a bug nobody backports. For the Proxmox VE 7 boxes still serving virtual machines from public addresses, July 2024's end-of-life date has just become the day their security updates stopped, and attackers appear to have noticed before their owners did.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.