Security Digest · Vulnerability record
CVE-2026-123158: OpenBSD OpenSSH vulnerability
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash).
CVSS 8.1 High Check exposure
Should you act?
Normal patch cycle
No exploitation signal; fix it in your next routine update if you are affected. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.
- Not in CISA KEV, but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
- Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
- Editorial verdict: Check exposure. SSHole: OpenSSH Password Bypass on Alpine and musl Linux — Most SSH servers run glibc and are not affected, but if you run OpenSSH on Alpine or another musl system with password logins enabled, this is a one-connection login with public details, so patch or turn off password authentication today.
What it is
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
Weakness type: CWE-394.
Product: OpenBSD OpenSSH · Assigned by: mitre · Published: 2026-11-05
Affected and fixed versions
| Vendor | Product | Affected versions (per CVE record) |
|---|---|---|
| OpenBSD | OpenSSH | < 10.6p2 |
Severity scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| mitre | 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
- Attack vector: network (remotely reachable)
- Attack complexity: high (needs special conditions)
- Privileges required: none (no login)
- User interaction: none
- Scope: unchanged
CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.
Exploitation and urgency
- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation poc, automatable no, technical impact total.
Timeline
- — CVE record published by mitre
- — erroneo.us brief: SSHole: OpenSSH Password Bypass on Alpine and musl Linux
- — CVE record last updated
Sources and references
Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.
Vulnerability records
- CVE.org record CVE-2026-123158 cve.org
- NVD entry CVE-2026-123158 nvd.nist.gov
Other references from the CVE record and advisory
- openssh.org openssh.org
- github.com github.com
- news.ycombinator.com news.ycombinator.com
- news.ycombinator.com news.ycombinator.com
- marc.info marc.info
- hachyderm.io hachyderm.io
- github.com github.com
- github.com github.com
- alpinelinux.org alpinelinux.org
- news.ycombinator.com news.ycombinator.com
- github.com github.com
- sshhole.com sshhole.com