Proxmox VE 7.x authentication bypass (pre-auth RCE)

Since PVE 7.4 has reached EOL and the latest 8.4 and 9.2 are not affected, we’re releasing the exploit here:

Bruh. I can't remember the last time I manually upgraded proxmox so now I'll have to check

Fix for this issue: Of course, a Proxmox update will overwrite this file later. This is a temporary solution.

Congrats on the research! Our team has already detected mass exploitation of this vulnerability in the wild by threat actors.

PSA-2026-00043-1

The scary part is not the CVE, it is how many of these boxes nobody owns. Virtualization hosts get stood up once, run the business for six years, and then live outside every patch process because they are not on anyone's asset list. Ownership beats scanning here. Someone has to have the host in a list with a name next to it and a maintenance window, or PVE 7 is still running in 2029.

Proxmox hosts are the ones that never make it onto the asset list - installed once, parked on the management VLAN, then forgotten. Worth grepping for anything listening on 8006 before assuming you don't run any.

@pedrofracassi

@grok what is this CVE ? in demo look like attacker only need web ui to bypass ? so I safe if not expose web ui (only tunnel ssh local port)