A critical authentication bypass vulnerability in Proxmox Virtual Environment allows unauthenticated attackers to gain full administrative access to the platform.

The flaw resides in the libpve-access-control component, where the API login endpoint fails to properly validate the tfa-challenge parameter. An unauthenticated attacker can supply an arbitrary value to this parameter to bypass password verification and authenticate as any enabled user, including the root account.

This vulnerability carries a CVSS score of 9.8, indicating a critical risk of total system compromise. Successful exploitation grants an attacker full control over the virtualization host, potentially leading to the theft of sensitive data, deployment of ransomware, or the destruction of virtual machine instances and their associated workloads.

Immediate Action: Upgrade all affected instances of Proxmox Virtual Environment to the latest supported version, as the vulnerable releases are end of life and require migration to a secure, maintained build.

Proactive Monitoring: Review system authentication logs for API login requests containing unusual or empty tfa-challenge parameters and monitor for unauthorized administrative sessions.

Compensating Controls: Implement strict network access controls to restrict access to the Proxmox management interface to trusted IP addresses only, and deploy a Web Application Firewall to filter suspicious API traffic.

Public Exploit Available: Unknown

Given the critical nature of this vulnerability and the potential for complete host takeover, organizations must prioritize upgrading their Proxmox infrastructure immediately. Since the affected versions are end of life, administrators should treat this as a high-priority migration task to ensure the security and integrity of the virtualized environment.