www.it-connect.fr
CVE-2023-54391: Proxmox Vulnerability Patched in 2023 Is Now Under Active Attack
133 IP addresses in three days, used to exploit a flaw patched three years ago without anyone noticing. Let’s take a look at CVE-2023-54391, a vulnerability that allows authentication bypass in Proxmox VE 7.0 to 8.0 via the API. Here’s what you need to know.
In July 2023, the vulnerable code related to CVE-2023-54391 was removed by the Proxmox team, directly in version 8.0.4 of the libpve-access-control package. Yet this flaw remained under the radar for three years, since it received this CVE identifier on September 1, 2026, when VulnCheck published its security advisory. That also means servers still running Proxmox VE 7 remained exposed for three years without knowing it!
So what is this vulnerability exactly?
One HTTP request is all it takes
For reference, the Proxmox VE virtualization platform is administered through a web interface and a REST API. By default, it ships with an admin account named root@pam, which corresponds to the host's root user itself.
In this vulnerability, the authentication API is what matters. Proxmox VE authenticates users through a POST request to the /api2/json/access/ticket endpoint, with a username and password. When an account has a second authentication factor enabled, the server answers the first request with a challenge, and the client sends a second request carrying a tfa-challenge value. The problem is that the code treated any request containing a tfa-challenge field as if the password check had already passed. For a user without a second authentication factor configured, there was nothing left to validate, and the server accepted the login.
In practice, an attacker only needs to send a single request with the targeted username, any string in the tfa-challenge field, and a password of their choice. In return, they get a valid session ticket and CSRF token, enough to access the web interface at leisure.
"An attacker with API access could authenticate as any existing and enabled user without a second factor configured, without knowing any credentials," Proxmox explains in its advisory. And what you need to understand is that, by default, the root@pam account falls into this vulnerable category. The problem is that a compromised account opens every door: virtual machines, storage, networking, and more...
This security flaw is considered critical, with a CVSS v4.0 score of 9.3 out of 10 according to VulnCheck. On top of that, there is already a public exploit in the form of a Nuclei template (an open-source web vulnerability scanner), which makes exploitation much easier.
What the CrowdSec network is seeing
What prompted me to write this article was a CrowdSec post about the attacks being observed. Because yes, this vulnerability is already being exploited. Even if it is not yet listed in the CISA KEV catalog, it is present in VulnCheck’s catalog. It is considered known and exploited as of now.
Between September 4 and September 6, 2026, the CrowdSec network recorded 1,210 signals matching the exploitation pattern for CVE-2023-54391, detected by a scenario published on September 4. That averages 403 signals per day, with a peak of 901 on the first day, and a total of 133 unique IP addresses behind these attempts (an attacker can use multiple IPs).
"Among the machines reporting these attempts to the CrowdSec network, 76% belong to small offices and home deployments, and 22% to enterprises. The organizations reporting these incidents are concentrated in France (40%), Italy (35%), and Germany (13%). These figures reflect CrowdSec coverage, not the global distribution of Proxmox deployments," the report states.
There are certainly many Proxmox VE servers exposed on the web, especially on dedicated servers hosted by cloud providers. On servers that are not updated regularly, this vulnerability could do serious damage.
How to protect yourself from CVE-2023-54391
The good news is that a fix has existed for a long time. You need to move to a supported version of Proxmox VE (8.x or later, with all updates applied), which includes libpve-access-control 8.0.4 or newer. Most importantly, Proxmox VE 7 reached end of life in July 2024: it will not receive a fix for this flaw.
However, the Proxmox VE security advisory provides a patch to apply manually using the sed command. This adds an extra validation step inside the vulnerable code. You can find the details on this page.
Over to you!
