CVE-2023-54391 Proxmox Server Solutions GmbH CVE debrief

Who should care

System administrators and security teams using Proxmox VE 7.0 through 8.0 with libpve-access-control before 8.0.4 should assess exposure and prioritize updating to version 8.0.4 or later.

Why it matters

CVE-2023-54391 is a critical authentication bypass vulnerability in Proxmox Virtual Environment (VE) 7.0 through 8.0. System administrators and security teams should assess exposure and prioritize updating to version 8.0.4 or later to prevent unauthorized access.

• Unauthenticated access to the system
• Potential for lateral movement
• Increased risk of data breaches
• Need for immediate patching or mitigation

Technical summary

The vulnerability exists in the libpve-access-control library before version 8.0.4, used in Proxmox Virtual Environment (VE) 7.0 through 8.0. An unauthenticated attacker can bypass authentication by providing an arbitrary tfa-challenge value in the API login endpoint, allowing access as any existing enabled user without a configured second factor. This vulnerability allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value in the API login endpoint. Attackers can send a POST request to the access ticket API endpoint with any value in the tfa-challenge parameter to completely skip password verification, gaining

Defensive priority

High priority for systems using Proxmox VE 7.0 through 8.0 with libpve-access-control before 8.0.4

Recommended defensive actions

• Immediately update libpve-access-control to version 8.0.4 or later
• Restrict access to the API login endpoint
• Monitor for suspicious login attempts
• Implement additional authentication measures
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the authentication bypass vulnerability in Proxmox VE. The vulnerability allows unauthenticated access to the system without a second factor. Affected releases are end of life. System administrators and security teams should assess exposure and prioritize updating to version 8.0.4 or later. Evidence is limited to public CVE details and NVD assessments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.