CVE-2023, PSA-2026: an old Proxmox VE bug exploited in the wild

CVE-2023, PSA-2026: an old Proxmox VE bug exploited in the wild

Proxmox issued PSA-2026-00043-1 for an authentication bypass affecting legacy versions of Proxmox VE. Versions of libpve-access-control >= 7.0-7 and < 8.0.4, used in Proxmox VE 7 and early PVE 8.0 builds, are vulnerable. Proxmox VE 7 has been EOL since July 2024; supported versions are not affected.

How the bypass works During authentication, the /api2/json/access/ticket endpoint accepts the tfa-challenge parameter — a signed ticket used to complete two-factor authentication. In vulnerable versions, the value of tfa-challenge was not validated for users without a configured second factor. At the same time, simply providing the parameter caused the password check to be skipped entirely. As a result, an attacker with access to the API could authenticate as any existing, enabled user without 2FA, without knowing any credentials, simply by supplying an arbitrary tfa-challenge value. By default, this includes root@pam. Exploitation requires access to the API on port 8006, either directly or through a reverse proxy. Users with any second factor configured are not affected.

Attack chain: API access over TCP/8006 → arbitrary tfa-challenge → password check bypassed → authentication as root@pam

The vulnerable code path was fixed in libpve-access-control 8.0.4, released on July 20, 2023, as a side effect of reworking TFA configuration handling for an unrelated issue. At the time, the authentication bypass was unknown, so the change was not recognized as a security fix and was not considered for backporting to the PVE 7 branch. Proxmox learned about the vulnerability only in 2026, after receiving multiple independent reports, including reports of exploitation in the wild, and issued PSA-2026-00043-1 for the affected EOL releases.

Proxmox recommends upgrading to a supported version — the only durable fix. For systems that cannot be upgraded immediately, the company published a temporary patch that requires every tfa-challenge value to be a valid, signed TFA challenge ticket that an attacker cannot forge. Proxmox also recommends restricting API access to trusted networks.

Advisory: https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/page-4#post-867929