Download the latest Vulnerability & Exploitation Report

Download now

CrowdSec

VulnTracking

Proxmox VE Authentication Bypass (CVE-2023-54391): Exploitation Attempts Target a Flaw Fixed Three Years Ago

CVE-2023-54391 is a CVSS 9.3 authentication bypass in Proxmox Virtual Environment 7.0 through 8.0. An attacker who can reach the login API can become any user without a second factor, including root@pam, with no password. CrowdSec observed 133 unique IP addresses sending matching requests since September 4, 2026. Upgrade to a supported Proxmox VE release and take the management interface off the internet.

CVE-2023-54391 at a glance

  • Affected: Proxmox VE 7.0 through 7.4 and the initial 8.0 release, i.e., libpve-access-control 7.0-7 through 8.0.3
  • Fixed in: libpve-access-control 8.0.4 (July 20, 2023). Proxmox VE 7.x is end-of-life and never received the fix.
  • Vulnerability class: Missing critical step in authentication (CWE-304)
  • Severity: CVSS 4.0 9.3 Critical (VulnCheck). NVD scores it 9.8 on CVSS 3.1.
  • Authentication required: None
  • Public exploit: Yes. A Nuclei template is public, and the request is a single POST.
  • CISA KEV: Not listed as of September 7, 2026. Listed in the VulnCheck KEV catalogue.
  • CrowdSec detection rule live since: September 4, 2026
  • First exploitation attempt observed: September 4, 2026
  • Exploitation phase: Early Exploitation (raised from Insufficient Data on September 5, 2026)
  • Observation window used here: September 4 to September 6, 2026 (3 days). The unique-IP count comes from the Live Exploit Tracker as of September 7, 2026.

Key findings

  • The fix is three years older than the CVE: Proxmox removed the faulty logic in July 2023 as part of routine 8.0 maintenance. The bug only received a CVE on September 1, 2026, when VulnCheck published an advisory, and Proxmox followed with PSA-2026-00043-1. CrowdSec’s detection rule went live on September 4 and matched traffic the same day. Anyone still on Proxmox VE 7 has been exposed the whole time without knowing it.
  • 1,210 signals from up to 58 addresses a day, front-loaded on the first day: Between September 4 and 6, the CrowdSec Network recorded 1,210 signals matching the CVE-2023-54391 pattern, averaging 403 a day. September 4 alone carried 901 of them, followed by 257 on September 5 and 52 on September 6.
  • The attack is one HTTP request and needs no credentials: A POST to the access ticket endpoint with any value in the tfa-challenge field skips password verification. The public Nuclei template sends exactly that, with root@pam as the target user, so the skill floor is a copy-paste.
  • Iran accounts for 68% of the source addresses, and one burst explains the chart: On September 4, 741 of the 901 signals came from Iranian addresses. Once that burst passed, daily volume dropped by 94% in two days. The decline suggests one operator finished a sweep, not that interest has faded.

What is Proxmox VE, and who is exposed to CVE-2023-54391?

Proxmox Virtual Environment is an open-source platform for running virtual machines and containers, popular with hosting providers, managed service providers, small IT teams, and home-lab owners who want a free alternative to VMware. It ships with a web interface and REST API on port 8006, and the account that manages it, root@pam, is the root user of the host itself.

Why CVE-2023-54391 matters: A session as root@pam is not access to one application. It is access to every virtual machine on the host, their disks, their backups, the storage configuration, and, in a cluster, every other node. An attacker who lands there can copy a customer’s database server as a file, add a backdoored VM, or wipe the lot. CrowdSec CTI classifies 88% of the observed intent as infrastructure takeover and 11% as ransomware, which fits a target that is itself a fleet of servers.

Among the machines reporting these attempts to the CrowdSec Network, 76% belong to small offices and home setups and 22% to commerce. Reporting organizations cluster in France (40%), Italy (35%) and Germany (13%). This describes where CrowdSec has visibility, not where Proxmox is deployed globally, though the home-lab share matches where end-of-life Proxmox VE 7 hosts tend to survive.

How does CVE-2023-54391 work?

Proxmox VE logs users in through a POST to /api2/json/access/ticket with a username and password. When a user has two-factor authentication configured, the server answers the first request with a challenge, and the client sends a second request carrying a tfa-challenge value plus the second factor. The bug is that the code treated any request containing a tfa-challenge field as one that had already passed password verification. For a user with no second factor configured, there was nothing left to check, so the server issued a valid ticket.

The attacker therefore sends a single request with the target username, any string as tfa-challenge, and whatever they like as the password. The response contains a session ticket and a CSRF token, which is everything the web interface needs. The root cause is a missing check that the challenge was one the server had actually issued.

What is the CrowdSec Network observing for CVE-2023-54391?

Between September 4 and September 6, 2026, the CrowdSec Network recorded 1,210 signals from machines reporting requests that match the CVE-2023-54391 exploitation pattern, detected by the CrowdSec scenario released on September 4, 2026. That averages 403 signals per day, peaking at 901 on September 4, with up to 58 distinct source addresses on a single day. The Live Exploit Tracker counts 133 unique IP addresses over its rolling window as of September 7.

The sources are unusually concentrated. Iran accounts for 68% of addresses, France for 14% and the United States for 8%. On the first day, Iranian addresses produced 741 of the 901 signals, which is the profile of one operator running a scanner across a target list rather than an exploit spreading through many toolkits. The French share is consistent with rented hosting used to scan French targets, given that France is also where most reporting machines sit.

The part worth flagging is the daily source count, which fell only from 58 to 54 between September 4 and 5 while signal volume fell by 71%. The loud sweep ended, but almost as many distinct addresses were still probing the following day. Early Exploitation is the right label: this is the phase where a CVE either gets absorbed into commodity scanners or is forgotten, and the next two weeks decide which.

What this data does not show

  • A matching request is an exploitation attempt. CrowdSec cannot confirm that any of them succeeded, and a request against a patched or supported host returns a login failure.
  • 133 unique IP addresses are not 133 threat actors. One operator rotating through cloud ranges inflates the count, and one address can be shared by many users.
  • These counts come from traffic reaching machines participating in the CrowdSec Network: a sample, not a census, and Proxmox hosts running CrowdSec are a specific slice of Proxmox hosts.
  • The scenario matches the request shape. It cannot separate a vulnerability scan by a researcher from an attacker’s attempt, and the public Nuclei template produces exactly the traffic it detects.
  • Three days is a short window. The trend line should not be read as a forecast.

What defenders get wrong about CVE-2023-54391

The first mistake is reading “fixed in 2023” as “not my problem”. Proxmox VE 7 reached end of life in July 2024 and never got the fix, and end-of-life hypervisors have a habit of staying in production because migrating the VMs on them is a project nobody wants to own. If a host was installed before mid-2023 and has not been through a major upgrade since, assume it is exposed until you have checked the package version yourself.

The second mistake is trusting two-factor authentication to cover this. It does, but only for the accounts that have it. The bypass works precisely on users with no second factor configured, and root@pam on a default install is one of them. Enabling TOTP on your own account while leaving root without it protects the wrong user.

Where this reasoning has limits: blocking at the network edge protects the login endpoint from the outside. It does nothing for a Proxmox host reachable from a compromised workstation on the management VLAN, and it does not tell you whether someone already used the bypass during the three years it went unnamed. If your host was reachable from the internet, audit users, API tokens, and recently created VMs before you decide the patch closed the matter.

How do you protect Proxmox VE against CVE-2023-54391?

Patch. Upgrade to a supported Proxmox VE release (8.x or later, with all current updates applied), which ships libpve-access-control 8.0.4 or newer (advisory). Proxmox VE 7 cannot be patched in place. Confirm with dpkg -l libpve-access-control on the host, and treat anything below 8.0.4 as vulnerable. Then remove port 8006 from the internet and put the interface behind a VPN, which Proxmox has recommended all along.

No virtual patch for this one. CrowdSec does not ship an AppSec rule for CVE-2023-54391. The bypass request looks like a normal second-factor login step, so a rule that blocks it would also block real two-factor users. Detection of the exploitation pattern runs network-side instead, through the scenario released on September 4, which is what feeds the numbers in this report.

Preemptive blocking. Subscribe to the CrowdSec Intelligence Blocklists to drop addresses already seen attacking the network. This covers known infrastructure and will not stop a first-seen address.

Stay up to date. The Live Exploit Tracker page for CVE-2023-54391 shows the exploitation phase, daily volume, and source countries as they change, so check it before deciding how urgent the migration is. Query the observed sources in CrowdSec CTI.

Sharing insights and taking swift action can collectively reduce the impact of these threats. This is your call to action for real-time threat intelligence and collaborative cybersecurity.

Full report, with the complete fact block, FAQ, and sources: https://www.crowdsec.net/vulntracking-report/cve-2023-54391

If you’re already subscribed, feel free to like and share this post to help your network stay informed about current threats.

WRITTEN BY