sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass…
Affects OpenSSH before 10.6p2 on Linux systems built with musl libc and PAM support disabled. Fixed in portable OpenSSH 10.6p2.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- Proof of concept public, per CISA
- Fix
- Fixed in 10.6p2
- Who is exposed
- Not reported
Do first: Upgrade to a fixed version: 10.6p2.
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 48/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 6 proofs of concept on GitHub
- Exploitation: poc
- Automatable: no
- Technical impact: total
Summary
The OpenSSH sshd server on Linux systems that use musl libc without PAM, such as Alpine Linux, can be attacked remotely, without logging in, to bypass password authentication. For some account configurations, any password between 256 and 1024 characters is accepted.
Read the original description
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
cve.now Index
- Exploitation22/40Public exploit on Exploit-DB or GitHub
- Exposure17/25No login or user action needed, reachable over the network without a login · Unknown: Advisories don't say whether default setups are affected
- Reach?/20Unknown. No tracked technology or package matched
- Severity9.1/10CVSS 8.1, total technical impact per CISA
- No patch0/5No signal
What would change the score
- Would score about 71 if added to CISA KEV
- Would score about 66 if CISA's SSVC rates exploitation active
- Would score about 53 if advisories confirm default setups are exposed
What to do
Upgrade to a fixed version: 10.6p2.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: poc · Automatable: no · Technical impact: total
- Record last updated1 day
- Exploit code on GitHub
gabrielunknown/CVE-2026-123158_SSHole
Affected versions
- OpenBSD OpenSSH
fixed in 10.6p2
Evidence 18
- Exploit
- Exploit
- Exploit
- Exploit
- Exploit
Show all 18 sourcesShow fewer sources
- Exploit
- Exploit
- Repository
- Repository
- Repository
- Repository
- Link
- Link
- Link
- Link
- Link
- Link
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-123158
Is CVE-2026-123158 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. Public exploit code exists (a proof of concept on GitHub).Source: cve.now feed data
What does this mean?
A flaw in sshd can bypass password authentication, so a login can succeed without the correct password.Source: openssh.org, github.com
Which versions are affected by CVE-2026-123158?
OpenSSH: before 10.6p2.Source: cve.now feed data
Am I affected, and how do I check?
Only OpenSSH versions before 10.6p2, on Linux, built with musl libc and with PAM support disabled. The advisory says this bypass affects some configurations and runtime configurations only. Check your OpenSSH version and whether your build uses musl libc without PAM.Source: openssh.org, github.com
How do I fix CVE-2026-123158?
Upgrade to portable OpenSSH 10.6p2, released on 2026-11-05.Source: openssh.org, github.com