Do Son 
TL;DR
Proxmox published advisory PSA-2026-00043-1 on September 1, 2026. It warns of a critical Proxmox VE authentication bypass in end-of-life 7.x releases. The pre-auth flaw is exploited in the wild, and proof-of-concept exploit code is now public. Attackers can log in as root without any password.
Why It Matters
Proxmox VE runs virtual machines and containers across many hosts. Therefore, root on the host means control of every guest it runs. This Proxmox VE authentication bypass hands that access to unauthenticated attackers.
The vendor confirms it learned of the bug through many independent reports within two days, which also reported exploitation in the wild. Affected admins now face a race against public exploit code.
Note on Identifiers
No CVE number is assigned yet. The original reporter says they will submit the flaw to MITRE. This report therefore tracks it by the vendor advisory ID, PSA-2026-00043-1.
How the Attack Works
The bug sits in the API login call at POST /api2/json/access/ticket. That call accepts a tfa-challenge parameter for two-factor logins. In affected versions, the code skips password verification when this parameter is present.
It also fails to validate the value for users without a second factor. As a result, an attacker sends any arbitrary tfa-challenge value. The server then authenticates them as an existing user, including root@pam by default. This report withholds the payload itself.
Exploitation Status
Proxmox confirms active exploitation in the wild. Independent researchers have also released technical write-ups and a public PoC. Security researcher Nebu Security published both an exploitation summary and a proof-of-concept gist.
Affected Versions
The flaw affects libpve-access-control from 7.0-7 up to before 8.0.4. That maps roughly to Proxmox VE 7.0 through 7.4 and the initial 8.0 release. Check the package version directly, since it correlates only loosely with the VE version.
Patch and Mitigation Steps
No supported Proxmox VE release is affected. The fix shipped in libpve-access-control 8.0.4 back in July 2023. Upgrading to a supported release is the only durable fix.
If You Cannot Upgrade Now
Restrict API port 8006 to trusted networks immediately. Users with any second factor configured are not affected. Proxmox also provides a stop-gap patch that validates the tfa-challenge ticket.
Support Our Threat Intelligence
Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
PayPal
