Medium SEVERITY — Security Update

PVE 8 GUI session security improvements

Hardening updates were released for web interface session management and CSRF validations.

Platform
Proxmox VE
Version
PVE 8 / Bookworm tabanlı
Published
15 November 2023
Views
36
Primary source: Review the official advisory at forum.proxmox.com Go to Source

Scope

  • Session cookie SameSite and rotation improvements
  • Tightening of CSRF token validation
  • Additional security headers for pveproxy

Recommendation: Continue to expose GUI access only via management VLAN/VPN — port 8006 should remain closed to the internet.

Proxmox VE — Related Advisories

VIEW ALL →
Proxmox VE 01 Sep 2026
Critical · 9.3

CVE-2023-54391 — Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-contro

Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value in the API login endpoint. Attackers can send a POST request to the access ticket API endpoint with any value in the tfa-challenge parameter to completely skip password verification

CVE-2023-54391 Vulnerability 42