CVE-2026-123158
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround...
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
- Record
CVE-2026-123158- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-394
- Updated
- 2026-11-06
EUVDEUVD-2026-117552
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
- Record
EUVD-2026-117552- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-4fcc-vm97-gx3x
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround...
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
- Record
GHSA-4fcc-vm97-gx3x- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-394
- Updated
- 2026-11-05
NVD
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
- Record
CVE-2026-123158- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-394
- Updated
- 2026-11-06
OSVALPINE-CVE-2026-123158
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
- Record
ALPINE-CVE-2026-123158- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-06
OSVBELL-CVE-2026-123158
- Record
BELL-CVE-2026-123158- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-07
OSV
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
- Record
CVE-2026-123158- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-394
- Updated
- 2026-11-07
OSVDEBIAN-CVE-2026-123158
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
- Record
DEBIAN-CVE-2026-123158- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-06
OSVUBUNTU-CVE-2026-123158 No score
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
- Record
UBUNTU-CVE-2026-123158- Updated
- 2026-11-07
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
opensshAlpine:v3.16 |
before 9.0_p1-r6 | 9.0_p1-r6 |
opensshAlpine:v3.17 |
before 9.1_p1-r7 | 9.1_p1-r7 |
opensshAlpine:v3.18 |
before 9.3_p2-r4 | 9.3_p2-r4 |
opensshAlpine:v3.19 |
before 9.6_p1-r3 | 9.6_p1-r3 |
opensshAlpine:v3.20 |
before 9.7_p1-r6 | 9.7_p1-r6 |
opensshAlpine:v3.21 |
before 9.9_p2-r1 | 9.9_p2-r1 |
opensshAlpine:v3.22 |
before 10.0_p1-r11 | 10.0_p1-r11 |
opensshAlpine:v3.23 |
before 10.2_p1-r1 | 10.2_p1-r1 |
opensshAlpine:v3.24 |
before 10.3_p1-r2 | 10.3_p1-r2 |
opensshAlpaquita:23 |
9.1_p1-r3 up to 9.1_p1-r17 | 9.1_p1-r17 |
Show 33 moreShow less
| Package | Affected | Fixed |
|---|---|---|
opensshAlpaquita:25 |
10.0_p1-r7 up to 10.6_p2-r0 | 10.6_p2-r0 |
opensshAlpaquita:stream |
10.0_p1-r7 up to 10.6_p2-r0 | 10.6_p2-r0 |
opensshBellSoft Hardened Containers:23 |
9.1_p1-r3 up to 9.1_p1-r17 | 9.1_p1-r17 |
opensshBellSoft Hardened Containers:25 |
10.0_p1-r7 up to 10.6_p2-r0 | 10.6_p2-r0 |
opensshBellSoft Hardened Containers:stream |
10.0_p1-r7 up to 10.6_p2-r0 | 10.6_p2-r0 |
opensshDebian:12 |
All versions, plus listed versions 1:10.0p1-11:10.0p1-21:10.0p1-31:10.0p1-41:10.0p1-5 Show 45 moreShow less1:10.0p1-5~bpo12+21:10.0p1-61:10.0p1-71:10.0p1-7~bpo12+11:10.0p1-81:10.1p1-11:10.1p1-21:10.2p1-11:10.2p1-21:10.2p1-2~bpo13+11:10.2p1-31:10.2p1-41:10.2p1-51:10.2p1-61:10.2p1-6~bpo13+11:10.3p1-11:10.3p1-1~bpo13+11:10.3p1-21:10.3p1-31:10.3p1-41:10.3p1-51:10.3p1-71:10.3p1-81:10.3p1-91:10.4p1-11:10.4p1-21:10.4p1-31:10.4p1-41:10.4p1-51:10.5p1-11:10.6p1-11:10.6p2-11:9.2p1-21:9.2p1-2+deb12u11:9.2p1-2+deb12u101:9.2p1-2+deb12u21:9.2p1-2+deb12u31:9.2p1-2+deb12u41:9.2p1-2+deb12u51:9.2p1-2+deb12u61:9.2p1-2+deb12u71:9.2p1-2+deb12u81:9.2p1-2+deb12u91:9.3p1-11:9.3p1-1+loong64 |
None known |
opensshDebian:13 |
All versions, plus listed versions 1:10.0p1-71:10.0p1-7+deb13u11:10.0p1-7+deb13u21:10.0p1-7+deb13u31:10.0p1-7+deb13u4 Show 28 moreShow less1:10.0p1-81:10.1p1-11:10.1p1-21:10.2p1-11:10.2p1-21:10.2p1-2~bpo13+11:10.2p1-31:10.2p1-41:10.2p1-51:10.2p1-61:10.2p1-6~bpo13+11:10.3p1-11:10.3p1-1~bpo13+11:10.3p1-21:10.3p1-31:10.3p1-41:10.3p1-51:10.3p1-71:10.3p1-81:10.3p1-91:10.4p1-11:10.4p1-21:10.4p1-31:10.4p1-41:10.4p1-51:10.5p1-11:10.6p1-11:10.6p2-1 |
None known |
opensshDebian:14 |
All versions, plus listed versions 1:10.0p1-71:10.0p1-81:10.1p1-11:10.1p1-21:10.2p1-1 Show 24 moreShow less1:10.2p1-21:10.2p1-2~bpo13+11:10.2p1-31:10.2p1-41:10.2p1-51:10.2p1-61:10.2p1-6~bpo13+11:10.3p1-11:10.3p1-1~bpo13+11:10.3p1-21:10.3p1-31:10.3p1-41:10.3p1-51:10.3p1-71:10.3p1-81:10.3p1-91:10.4p1-11:10.4p1-21:10.4p1-31:10.4p1-41:10.4p1-51:10.5p1-11:10.6p1-11:10.6p2-1 |
None known |
openssh-gssapiDebian:14 |
All versions, plus listed versions 1:10.4p1-51:10.5p1-11:10.6p1-11:10.6p2-1 |
None known |
opensshUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1:6.2p2-61:6.2p2-6ubuntu11:6.4p1-11:6.4p1-21:6.5p1-1 Show 22 moreShow less1:6.5p1-21:6.5p1-31:6.5p1-41:6.5p1-61:6.6p1-11:6.6p1-21:6.6p1-2ubuntu11:6.6p1-2ubuntu21:6.6p1-2ubuntu2.21:6.6p1-2ubuntu2.31:6.6p1-2ubuntu2.41:6.6p1-2ubuntu2.61:6.6p1-2ubuntu2.71:6.6p1-2ubuntu2.81:6.6p1-2ubuntu2.101:6.6p1-2ubuntu2.111:6.6p1-2ubuntu2.121:6.6p1-2ubuntu2.131:6.6p1-2ubuntu2.13+esm11:6.6p1-2ubuntu2.13+esm21:6.6p1-2ubuntu2.13+esm31:6.6p1-2ubuntu2.13+esm4 |
None known |
opensshUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1:6.9p1-21:6.9p1-31:7.1p1-11:7.1p1-31:7.1p1-4 Show 27 moreShow less1:7.1p1-61:7.1p2-11:7.1p2-21:7.2p1-11:7.2p2-11:7.2p2-21:7.2p2-31:7.2p2-41:7.2p2-4ubuntu11:7.2p2-4ubuntu2.11:7.2p2-4ubuntu2.21:7.2p2-4ubuntu2.41:7.2p2-4ubuntu2.51:7.2p2-4ubuntu2.61:7.2p2-4ubuntu2.71:7.2p2-4ubuntu2.81:7.2p2-4ubuntu2.101:7.2p2-4ubuntu2.10+esm11:7.2p2-4ubuntu2.10+esm21:7.2p2-4ubuntu2.10+esm31:7.2p2-4ubuntu2.10+esm41:7.2p2-4ubuntu2.10+esm51:7.2p2-4ubuntu2.10+esm61:7.2p2-4ubuntu2.10+esm71:7.2p2-4ubuntu2.10+esm81:7.2p2-4ubuntu2.10+esm91:7.2p2-4ubuntu2.10+esm10 |
None known |
opensshUbuntu:Pro:FIPS-updates:16.04:LTS |
All versions, plus listed versions 1:7.2p2-4ubuntu2.fips.2.2.31:7.2p2-4ubuntu2.fips.2.4.11:7.2p2-4ubuntu2.fips.2.4.21:7.2p2-4ubuntu2.fips.2.8.11:7.2p2-4ubuntu2.fips.2.10.1 Show 6 moreShow less1:7.2p2-4ubuntu2.fips.2.10.21:7.2p2-4ubuntu2.fips.2.10.31:7.2p2-4ubuntu2.fips.2.10.41:7.2p2-4ubuntu2.fips.2.10.51:7.2p2-4ubuntu2.fips.2.10.61:7.2p2-4ubuntu2.fips.2.10.7 |
None known |
opensshUbuntu:Pro:FIPS:16.04:LTS |
All versions, plus listed versions 1:7.2p2-4ubuntu2.fips.2.21:7.2p2-4ubuntu2.fips.2.2.11:7.2p2-4ubuntu2.fips.2.10.1 |
None known |
opensshUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1:7.5p1-101:7.6p1-41:7.6p1-4ubuntu0.11:7.6p1-4ubuntu0.21:7.6p1-4ubuntu0.3 Show 9 moreShow less1:7.6p1-4ubuntu0.51:7.6p1-4ubuntu0.61:7.6p1-4ubuntu0.71:7.6p1-4ubuntu0.7+esm11:7.6p1-4ubuntu0.7+esm21:7.6p1-4ubuntu0.7+esm31:7.6p1-4ubuntu0.7+esm41:7.6p1-4ubuntu0.7+esm51:7.6p1-4ubuntu0.7+esm6 |
None known |
openssh-ssh1Ubuntu:18.04:LTS |
All versions, plus listed versions 1:7.5p1-81:7.5p1-91:7.5p1-9build11:7.5p1-10 |
None known |
opensshUbuntu:Pro:FIPS-updates:18.04:LTS |
All versions, plus listed versions 1:7.9p1-10~ubuntu18.04.fips.0.11:7.9p1-10~ubuntu18.04.fips.0.21:7.9p1-10~ubuntu18.04.fips.0.31:7.9p1-10~ubuntu18.04.fips.0.41:7.9p1-10~ubuntu18.04.fips.0.5 Show 5 moreShow less1:7.9p1-10~ubuntu18.04.fips.0.61:7.9p1-10~ubuntu18.04.fips.0.71:7.9p1-10~ubuntu18.04.fips.0.81:7.9p1-10~ubuntu18.04.fips.0.91:7.9p1-10~ubuntu18.04.fips.0.10 |
None known |
opensshUbuntu:Pro:FIPS:18.04:LTS |
All versions, plus listed versions 1:7.9p1-10~ubuntu18.04.fips.0.11:7.9p1-10~ubuntu18.04.fips.0.2 |
None known |
opensshUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1:8.0p1-6build11:8.1p1-11:8.1p1-51:8.2p1-41:8.2p1-4ubuntu0.1 Show 14 moreShow less1:8.2p1-4ubuntu0.21:8.2p1-4ubuntu0.31:8.2p1-4ubuntu0.41:8.2p1-4ubuntu0.51:8.2p1-4ubuntu0.71:8.2p1-4ubuntu0.81:8.2p1-4ubuntu0.91:8.2p1-4ubuntu0.101:8.2p1-4ubuntu0.111:8.2p1-4ubuntu0.121:8.2p1-4ubuntu0.131:8.2p1-4ubuntu0.13+esm11:8.2p1-4ubuntu0.13+esm21:8.2p1-4ubuntu0.13+esm3 |
None known |
openssh-ssh1Ubuntu:20.04:LTS |
All versions, plus listed versions 1:7.5p1-11build1 |
None known |
opensshUbuntu:Pro:FIPS-updates:20.04:LTS |
All versions, plus listed versions 1:8.2p1-4ubuntu0.fips.0.2.11:8.2p1-4ubuntu0.fips.0.4.01:8.2p1-4ubuntu0.fips.0.5.01:8.2p1-4ubuntu0.fips.0.71:8.2p1-4ubuntu0.fips.0.8 Show 7 moreShow less1:8.2p1-4ubuntu0.fips.0.91:8.2p1-4ubuntu0.fips.0.101:8.2p1-4ubuntu0.fips.0.111:8.2p1-4ubuntu0.fips.0.121:8.2p1-4ubuntu0.fips.0.131:8.2p1-4ubuntu0.fips.0.13.11:8.2p1-4ubuntu0.fips.0.13.3 |
None known |
opensshUbuntu:Pro:FIPS:20.04:LTS |
All versions, plus listed versions 1:8.2p1-4ubuntu0.fips.0.2.1 |
None known |
opensshUbuntu:22.04:LTS |
All versions, plus listed versions 1:8.4p1-6ubuntu21:8.7p1-21:8.7p1-2build11:8.7p1-41:8.8p1-1 Show 15 moreShow less1:8.9p1-31:8.9p1-3ubuntu0.11:8.9p1-3ubuntu0.31:8.9p1-3ubuntu0.41:8.9p1-3ubuntu0.51:8.9p1-3ubuntu0.61:8.9p1-3ubuntu0.71:8.9p1-3ubuntu0.101:8.9p1-3ubuntu0.111:8.9p1-3ubuntu0.131:8.9p1-3ubuntu0.141:8.9p1-3ubuntu0.151:8.9p1-3ubuntu0.161:8.9p1-3ubuntu0.171:8.9p1-3ubuntu0.18 |
None known |
openssh-ssh1Ubuntu:22.04:LTS |
All versions, plus listed versions 1:7.5p1-121:7.5p1-12build11:7.5p1-13 |
None known |
opensshUbuntu:Pro:FIPS-preview:22.04:LTS |
All versions, plus listed versions 1:8.9p1-3ubuntu0.4+Fips11:8.9p1-3ubuntu0.4+Fips31:8.9p1-3ubuntu1.fips.0~ppa3 |
None known |
opensshUbuntu:Pro:FIPS-updates:22.04:LTS |
All versions, plus listed versions 1:8.9p1-3ubuntu0.4+Fips11:8.9p1-3ubuntu0.4+Fips31:8.9p1-3ubuntu0.6+Fips11:8.9p1-3ubuntu0.7+Fips11:8.9p1-3ubuntu0.10+Fips1 Show 8 moreShow less1:8.9p1-3ubuntu0.11+Fips11:8.9p1-3ubuntu0.13+Fips11:8.9p1-3ubuntu0.14+Fips11:8.9p1-3ubuntu0.15+Fips11:8.9p1-3ubuntu0.15+Fips31:8.9p1-3ubuntu0.16+Fips31:8.9p1-3ubuntu0.18+Fips11:8.9p1-3ubuntu1.fips.0~ppa3 |
None known |
opensshUbuntu:24.04:LTS |
All versions, plus listed versions 1:9.3p1-1ubuntu31:9.4p1-1ubuntu11:9.6p1-3ubuntu11:9.6p1-3ubuntu21:9.6p1-3ubuntu11 Show 17 moreShow less1:9.6p1-3ubuntu121:9.6p1-3ubuntu131:9.6p1-3ubuntu13.31:9.6p1-3ubuntu13.41:9.6p1-3ubuntu13.51:9.6p1-3ubuntu13.71:9.6p1-3ubuntu13.81:9.6p1-3ubuntu13.91:9.6p1-3ubuntu13.111:9.6p1-3ubuntu13.121:9.6p1-3ubuntu13.131:9.6p1-3ubuntu13.141:9.6p1-3ubuntu13.151:9.6p1-3ubuntu13.161:9.6p1-3ubuntu13.181:9.6p1-3ubuntu13.191:9.6p1-3ubuntu13.20 |
None known |
openssh-ssh1Ubuntu:24.04:LTS |
All versions, plus listed versions 1:7.5p1-141:7.5p1-151:7.5p1-15build11:7.5p1-16 |
None known |
opensshUbuntu:Pro:FIPS-updates:24.04:LTS |
All versions, plus listed versions 1:9.6p1-3ubuntu13.7+Fips11:9.6p1-3ubuntu13.12+Fips11:9.6p1-3ubuntu13.13+Fips11:9.6p1-3ubuntu13.14+Fips11:9.6p1-3ubuntu13.15+Fips1 Show 5 moreShow less1:9.6p1-3ubuntu13.16+Fips11:9.6p1-3ubuntu13.16+Fips21:9.6p1-3ubuntu13.18+Fips11:9.6p1-3ubuntu13.19+Fips11:9.6p1-3ubuntu13.20+Fips1 |
None known |
opensshUbuntu:26.10 |
All versions, plus listed versions 1:10.2p1-2ubuntu31:10.3p1-4ubuntu11:10.3p1-4ubuntu21:10.5p1-1ubuntu21:10.5p1-1ubuntu3.1 |
None known |
openssh-gssapiUbuntu:26.10 |
All versions, plus listed versions 1:10.5p1-1ubuntu11:10.5p1-1ubuntu21:10.5p1-1ubuntu31:10.5p1-1ubuntu3.1 |
None known |
openssh-ssh1Ubuntu:26.10 |
All versions, plus listed versions 1:7.5p1-181:7.5p1-18ubuntu11:7.5p1-18ubuntu2 |
None known |
opensshUbuntu:26.04:LTS |
All versions, plus listed versions 1:10.0p1-5ubuntu51:10.2p1-2ubuntu11:10.2p1-2ubuntu31:10.2p1-2ubuntu3.21:10.2p1-2ubuntu3.4 Show 4 moreShow less1:10.2p1-2ubuntu3.51:10.2p1-2ubuntu3.61:10.2p1-2ubuntu3.71:10.2p1-2ubuntu3.8 |
None known |
openssh-ssh1Ubuntu:26.04:LTS |
All versions, plus listed versions 1:7.5p1-171:7.5p1-18 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | 0xBlackash/CVE-2026-123158 | 2026-11-05 |
| PoC in GitHub | The-DevOps-Daily/alpine-sshd-check | 2026-11-05 |
| PoC in GitHub | coboliqcom/cve-2026-123158-sshole-safe-rust | 2026-11-05 |
| PoC in GitHub | ersinkoc/sshole-check | 2026-11-05 |
| PoC in GitHub | gabrielunknown/CVE-2026-123158_SSHole | 2026-11-05 |
| PoC in GitHub | rothoma2/cve-2026-123158-sshole | 2026-11-05 |
| PoC in GitHub | HackSpeak/CVE-2026-123158 | 2026-11-06 |
| PoC in GitHub | Hel1um17/sshole-bypass-openssh-password | 2026-11-06 |
| PoC in GitHub | Maalfer/CVE-2026-123158 | 2026-11-06 |
| PoC in GitHub | akarkode/alpine-openssh-sshole-auth-bypass | 2026-11-06 |
Show 5 moreShow less
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | ansonhsu-ai/sshhole-cve-2026-123158-ste | 2026-11-06 |
| PoC in GitHub | mlazzarotto/ansible-sshole-remediate | 2026-11-06 |
| PoC in GitHub | shenxianpeng/check-sshole | 2026-11-06 |
| PoC in GitHub | techdevfun/alpinegate | 2026-11-06 |
| PoC in GitHub | techtaek77/sshole-guide | 2026-11-06 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected, aliases, references | OSV | |
| affected, aliases, references | OSV | |
| exploits, facts | OSV, PoC in GitHub | |
| affected, aliases, facts, references | OSV | |
| references | CVE List, EUVD, NVD, OSV | |
| references | CVE List, EUVD | |
| references | OSV | |
| references | EUVD, GitHub Advisories, NVD | |
| aliases, references, title | GitHub Advisories |
Show 4 moreShow less
| Recorded | Changed | Sources |
|---|---|---|
| references | CVE List | |
| aliases, published | EUVD | |
| references | CVE List | |
| first indexed | CVE List |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-123158 is a high vulnerability (CVSS 8.1) in Openbsd Openssh, published November 5, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.98%, the 62nd percentile. Fixed in openssh 9.0_p1-r6.
References
openssh.org/releasenotes.html
github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482
news.ycombinator.com/item?id=50377976
marc.info?l=openssh-unix-dev&m=179388064263131&w=2
hachyderm.io/@damienmiller/117563026759098135
Show 15 moreShow less
alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass
sshhole.com
nvd.nist.gov/vuln/detail/CVE-2026-123158
security.alpinelinux.org/vuln/CVE-2026-123158
docs.bell-sw.com/security/cves/CVE-2026-123158
security-tracker.debian.org/tracker/CVE-2026-123158
ubuntu.com/security/CVE-2026-123158
cve.org/CVERecord?id=CVE-2026-123158
openwall.com/lists/oss-security/2026/11/05/3
Left out here: 29 versions. The JSON record has them.