Description

Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value in the API login endpoint. Attackers can send a POST request to the access ticket API endpoint with any value in the tfa-challenge parameter to completely skip password verification, gaining unauthorized access including to the root@pam account. All affected releases are end of life.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-01T22:17:10.283Z",
  "pubdate": "2026-09-01T22:17:10.283Z",
  "executiveSummary": "Proxmox Virtual Environment (VE) versions 7.0 through 8.0 are susceptible to a critical authentication bypass vulnerability originating in the libpve-access-control component. This vulnerability allows an unauthenticated remote attacker to circumvent password verification mechanisms entirely. By manipulating the tfa-challenge parameter during the API authentication handshake, an adversary can authenticate as any existing user on the system, including the highly privileged root@pam account. This flaw poses a severe risk to organizational infrastructure, as it effectively renders authentication controls void for users without mandatory two-factor authentication (TFA). The vulnerability allows for full administrative control over the Proxmox environment, facilitating unauthorized data access, virtual machine manipulation, and potential host compromise. Given that all affected versions are now end-of-life, the risk of exploitation is high, and the attack surface is exposed to any network entity capable of reaching the Proxmox API.",
  "technicalDetails": "The vulnerability resides within the authentication logic of the libpve-access-control library, specifically impacting the API endpoint responsible for issuing access tickets (typically /api2/json/access/ticket). The root cause of this flaw is an improper validation sequence during the login process, where the backend fails to enforce password verification when a specifically crafted tfa-challenge parameter is provided by the client.\nDuring normal operation, a user submits credentials (username and password) to the ticket API endpoint. If TFA is enabled, the system prompts for a challenge. However, in the vulnerable versions of libpve-access-control (prior to 8.0.4), the implementation of the authentication check contains a logic path that accepts the presence of an arbitrary string in the tfa-challenge field as a signal to bypass the password verification stage. Essentially, the code assumes that if a challenge value is supplied, the authentication phase is already validated or should be skipped, allowing the ticket generation process to proceed without a successful cryptographic password check.\nThe exploitation flow is straightforward and does not require pre-existing authentication or specialized cryptographic material. An attacker initiates a POST request to the API login endpoint, supplying a target username (e.g., 'root@pam') and an arbitrary, non-null value for the tfa-challenge parameter. The vulnerable application logic processes this request and, due to the missing conditional check, grants a valid session access ticket for the specified user account. Because the ticket is generated as if the user had provided a correct password, the server responds with a session cookie or token that establishes an authenticated context.\nThe scope of this vulnerability is total; it affects any user account configured on the Proxmox VE system that does not have second-factor authentication active. Successfully gaining an access ticket as the root@pam user provides the attacker with full control over the Proxmox cluster, including the ability to modify virtual machine configurations, access sensitive disk images, intercept network traffic, and execute commands at the host level via shell access or API functions. The vulnerability requires no privilege escalation because the authentication bypass itself places the attacker directly into the security context of the target account. Given that the affected versions are end-of-life, these systems lack the critical security patches required to close this logic flaw, making immediate migration to supported versions the only viable remediation."
}