Summary
CVE-2026-94588 is an authentication bypass flaw in Proxmox Virtual Environment's libpve-access-control. Supplying an arbitrary tfa-challenge value to the access-ticket API endpoint skips second-factor verification entirely, allowing unauthenticated attackers to obtain a valid access ticket as any enabled user, including root@pam.
Affected Asset
Proxmox Virtual Environment (VE) 7.0 through 8.0 running libpve-access-control before version 8.0.4; homelab deployments exposing the PVE web/API interface.
Affected Endpoint
/api2/json/access/ticket POST endpoint (tfa-challenge parameter).
Prerequisites
Network reachability to the Proxmox VE API (e.g., exposed to LAN or internet); an existing enabled user account (target for authentication bypass).
Steps to Reproduce
1. Enumerate valid usernames on the target Proxmox VE host (e.g., root@pam). 2. Send a POST request to /api2/json/access/ticket with an arbitrary tfa-challenge parameter for the target username. 3. Observe that Proxmox returns a valid PVEAuthCookie/ticket without validating the challenge against configured second-factor state. 4. Use the obtained ticket to issue privileged API calls as the authenticated user.
Evidence
OpenCVE entry for CVE-2026-94588; Red Hat Bugzilla #2506209; Proxmox Security Advisory Forum thread describing the tfa-challenge bypass of libpve-access-control before 8.0.4.
Impact
Unauthenticated full compromise of the Proxmox VE management plane. Attacker gains a session as root@pam and can manage all VMs/LXC containers, modify storage/network, export backups, or escape to the host via malicious guest configuration. In homelab setups this typically means total infrastructure compromise.
Root Cause
libpve-access-control's access-ticket handler accepts a caller-supplied tfa-challenge value without verifying it against the user's configured second-factor authentication state. Because the challenge is never checked, the second-factor gate is bypassed entirely and password verification is skipped for the resulting session.
Remediation
Upgrade libpve-access-control to version 8.0.4 or later on every Proxmox node (apt update && apt install --only-upgrade libpve-access-control). If immediate upgrade is not possible, restrict API access to trusted networks via firewall/VPN and enforce two-factor authentication for all admin accounts.
Verification Steps
Confirm installed version: dpkg -l libpve-access-control | awk '/libpve-access-control/ {print $3}'. Verify 8.0.4+. Test that a POST to /api2/json/access/ticket with a bogus tfa-challenge is rejected with an authentication error. Review access logs for unexpected ticket issuance.