Proxmox VE Authentication Bypass via TFA Challenge Manipulation

Technical Analysis

The vulnerability resides in libpve-access-control prior to version 8.0.4, where the access ticket API endpoint fails to properly validate the tfa-challenge parameter during the second-factor authentication flow. By submitting a POST request with any arbitrary value in this field, an attacker can trick the endpoint into treating the request as already password-verified, bypassing both primary credential checks and any configured TFA. This grants unauthenticated remote access to any enabled account, including root@pam, effectively yielding full administrative control of the Proxmox hypervisor and all guest VMs/containers it manages. Given the criticality (CVSS 9.8) and lack of prerequisite conditions (no authentication or user interaction required), this is trivially exploitable and likely to be weaponized rapidly once public PoCs circulate. Organizations running AI agent infrastructure, RAG pipelines, or LLM tool-use environments on virtualized hosts under Proxmox VE are directly exposed: a compromised hypervisor exposes all guest workloads, including agent orchestration nodes, vector databases, and stored API keys/secrets used for model access, enabling full data exfiltration or lateral movement into agent-connected systems.

Affected Systems

Proxmox Virtual Environment 7.0 through 8.0, specifically libpve-access-control versions prior to 8.0.4. Both root@pam and other enabled local/PAM-authenticated accounts are affected regardless of whether TFA is configured. Affected releases are officially end-of-life and no longer receive vendor patches.

Indicators of Compromise

• POST requests to /api2/json/access/ticket containing anomalous or arbitrary tfa-challenge parameter values
• Unexpected authentication success logs for accounts with TFA enabled but no valid second-factor response
• Unusual root@pam login events without corresponding TOTP/U2F/YubiKey verification in audit logs
• Anomalous API access patterns from unrecognized source IPs against Proxmox management interface (port 8006)

Remediation Steps

1. 1

   Upgrade Proxmox VE immediately

   Migrate to a supported Proxmox VE release with libpve-access-control 8.0.4 or later, as affected versions are end-of-life and will not receive official fixes.

2. 2

   Restrict management interface access

   Limit access to the Proxmox web UI and API (port 8006) to trusted internal networks or VPN, and enforce IP allowlisting/firewall rules.

3. 3

   Audit authentication logs

   Review access logs for anomalous login events, especially successful authentications for TFA-enabled accounts, to identify potential prior exploitation.

4. 4

   Rotate credentials and secrets

   Reset all Proxmox account passwords and API tokens, and rotate any credentials or API keys stored on or accessible from guest VMs/containers hosted on affected hypervisors, including keys used by AI agent workloads.

5. 5

   Enable enhanced monitoring

   Deploy intrusion detection focused on the Proxmox API login endpoint and alert on repeated or malformed tfa-challenge submissions.

6. 6

   Isolate critical workloads

   Where immediate patching is not possible, isolate high-value guest VMs (including AI agent and data infrastructure) onto separately managed, patched hypervisor clusters.