CVE-2026-123158
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround...
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
- Record
CVE-2026-123158- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-394
- Updated
- 2026-11-10
EUVDEUVD-2026-117552
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
- Record
EUVD-2026-117552- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-09
GitHub AdvisoriesGHSA-4fcc-vm97-gx3x
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround...
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
- Record
GHSA-4fcc-vm97-gx3x- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-394
- Updated
- 2026-11-10
CISA KEVNo score
OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability
OpenBSD OpenSSH on Linux contains an unexpected status code or return value vulnerability that could allow for authentication bypass.
- Record
CVE-2026-123158- Weakness
- CWE-394
- Updated
- 2026-11-09
NVD
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
- Record
CVE-2026-123158- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-394
- Updated
- 2026-11-10
OSVALPINE-CVE-2026-123158
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
- Record
ALPINE-CVE-2026-123158- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-06
Show 5 moreShow less
OSVBELL-CVE-2026-123158
- Record
BELL-CVE-2026-123158- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-07
OSV
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
- Record
CVE-2026-123158- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-394
- Updated
- 2026-11-10
OSVDEBIAN-CVE-2026-123158
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
- Record
DEBIAN-CVE-2026-123158- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-08
OSVUBUNTU-CVE-2026-123158
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
- Record
UBUNTU-CVE-2026-123158- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-11
OSVAZL-112871No score
CVE-2026-123158 affecting package openssh 9.8p1-10
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
- Record
AZL-112871- Updated
- 2026-11-09
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
opensshAlpine:v3.16 | before 9.0_p1-r6 | 9.0_p1-r6 |
opensshAlpine:v3.17 | before 9.1_p1-r7 | 9.1_p1-r7 |
opensshAlpine:v3.18 | before 9.3_p2-r4 | 9.3_p2-r4 |
opensshAlpine:v3.19 | before 9.6_p1-r3 | 9.6_p1-r3 |
opensshAlpine:v3.20 | before 9.7_p1-r6 | 9.7_p1-r6 |
opensshAlpine:v3.21 | before 9.9_p2-r1 | 9.9_p2-r1 |
opensshAlpine:v3.22 | before 10.0_p1-r11 | 10.0_p1-r11 |
opensshAlpine:v3.23 | before 10.2_p1-r1 | 10.2_p1-r1 |
opensshAlpine:v3.24 | before 10.3_p1-r2 | 10.3_p1-r2 |
opensshAzure Linux:3 | through 9.8p1-10 | None known |
Show 16 moreShow less
| Package | Affected | Fixed |
|---|---|---|
opensshAlpaquita:23 | 9.1_p1-r3 up to 9.1_p1-r17 | 9.1_p1-r17 |
opensshAlpaquita:25 | 10.0_p1-r7 up to 10.6_p2-r0 | 10.6_p2-r0 |
opensshAlpaquita:stream | 10.0_p1-r7 up to 10.6_p2-r0 | 10.6_p2-r0 |
opensshBellSoft Hardened Containers:23 | 9.1_p1-r3 up to 9.1_p1-r17 | 9.1_p1-r17 |
opensshBellSoft Hardened Containers:25 | 10.0_p1-r7 up to 10.6_p2-r0 | 10.6_p2-r0 |
opensshBellSoft Hardened Containers:stream | 10.0_p1-r7 up to 10.6_p2-r0 | 10.6_p2-r0 |
opensshDebian:12 | All versions, plus listed versions 1:10.0p1-11:10.0p1-21:10.0p1-31:10.0p1-41:10.0p1-5 Show 45 moreShow less1:10.0p1-5~bpo12+21:10.0p1-61:10.0p1-71:10.0p1-7~bpo12+11:10.0p1-81:10.1p1-11:10.1p1-21:10.2p1-11:10.2p1-21:10.2p1-2~bpo13+11:10.2p1-31:10.2p1-41:10.2p1-51:10.2p1-61:10.2p1-6~bpo13+11:10.3p1-11:10.3p1-1~bpo13+11:10.3p1-21:10.3p1-31:10.3p1-41:10.3p1-51:10.3p1-71:10.3p1-81:10.3p1-91:10.4p1-11:10.4p1-21:10.4p1-31:10.4p1-41:10.4p1-51:10.5p1-11:10.6p1-11:10.6p2-11:9.2p1-21:9.2p1-2+deb12u11:9.2p1-2+deb12u101:9.2p1-2+deb12u21:9.2p1-2+deb12u31:9.2p1-2+deb12u41:9.2p1-2+deb12u51:9.2p1-2+deb12u61:9.2p1-2+deb12u71:9.2p1-2+deb12u81:9.2p1-2+deb12u91:9.3p1-11:9.3p1-1+loong64 | None known |
opensshDebian:13 | All versions, plus listed versions 1:10.0p1-71:10.0p1-7+deb13u11:10.0p1-7+deb13u21:10.0p1-7+deb13u31:10.0p1-7+deb13u4 Show 28 moreShow less1:10.0p1-81:10.1p1-11:10.1p1-21:10.2p1-11:10.2p1-21:10.2p1-2~bpo13+11:10.2p1-31:10.2p1-41:10.2p1-51:10.2p1-61:10.2p1-6~bpo13+11:10.3p1-11:10.3p1-1~bpo13+11:10.3p1-21:10.3p1-31:10.3p1-41:10.3p1-51:10.3p1-71:10.3p1-81:10.3p1-91:10.4p1-11:10.4p1-21:10.4p1-31:10.4p1-41:10.4p1-51:10.5p1-11:10.6p1-11:10.6p2-1 | None known |
opensshDebian:14 | before 1:10.6p2-1, plus listed versions 1:10.0p1-71:10.0p1-81:10.1p1-11:10.1p1-21:10.2p1-1 Show 23 moreShow less1:10.2p1-21:10.2p1-2~bpo13+11:10.2p1-31:10.2p1-41:10.2p1-51:10.2p1-61:10.2p1-6~bpo13+11:10.3p1-11:10.3p1-1~bpo13+11:10.3p1-21:10.3p1-31:10.3p1-41:10.3p1-51:10.3p1-71:10.3p1-81:10.3p1-91:10.4p1-11:10.4p1-21:10.4p1-31:10.4p1-41:10.4p1-51:10.5p1-11:10.6p1-1 | 1:10.6p2-1 |
openssh-gssapiDebian:14 | before 1:10.6p2-1, plus listed versions 1:10.4p1-51:10.5p1-11:10.6p1-1 | 1:10.6p2-1 |
openssh-ssh1Ubuntu:18.04:LTS | All versions, plus listed versions 1:7.5p1-81:7.5p1-91:7.5p1-9build11:7.5p1-10 | None known |
openssh-ssh1Ubuntu:20.04:LTS | All versions, plus listed versions 1:7.5p1-11build1 | None known |
openssh-ssh1Ubuntu:22.04:LTS | All versions, plus listed versions 1:7.5p1-121:7.5p1-12build11:7.5p1-13 | None known |
openssh-ssh1Ubuntu:24.04:LTS | All versions, plus listed versions 1:7.5p1-141:7.5p1-151:7.5p1-15build11:7.5p1-16 | None known |
openssh-ssh1Ubuntu:26.10 | All versions, plus listed versions 1:7.5p1-181:7.5p1-18ubuntu11:7.5p1-18ubuntu2 | None known |
openssh-ssh1Ubuntu:26.04:LTS | All versions, plus listed versions 1:7.5p1-171:7.5p1-18 | None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | The-DevOps-Daily/alpine-sshd-check | 2026-11-05 |
| PoC in GitHub | ashrafzaryouh/CVE-2026-123158 | 2026-11-05 |
| PoC in GitHub | coboliqcom/cve-2026-123158-sshole-safe-rust | 2026-11-05 |
| PoC in GitHub | ersinkoc/sshole-check | 2026-11-05 |
| PoC in GitHub | gabrielunknown/CVE-2026-123158_SSHole | 2026-11-05 |
| PoC in GitHub | rothoma2/cve-2026-123158-sshole | 2026-11-05 |
| PoC in GitHub | CriticalWombat/sshole_scanner-CVE-2026-123158 | 2026-11-06 |
| PoC in GitHub | Funcan/sshole | 2026-11-06 |
| PoC in GitHub | HackSpeak/CVE-2026-123158 | 2026-11-06 |
| PoC in GitHub | Hel1um17/sshole-bypass-openssh-password | 2026-11-06 |
Show 15 moreShow less
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | Maalfer/CVE-2026-123158 | 2026-11-06 |
| PoC in GitHub | akarkode/alpine-openssh-sshole-auth-bypass | 2026-11-06 |
| PoC in GitHub | ansonhsu-ai/sshhole-cve-2026-123158-ste | 2026-11-06 |
| PoC in GitHub | crash00xd/CVE-2026-123158_SSHRole_PoC | 2026-11-06 |
| PoC in GitHub | halilkirazkaya/CVE-2026-123158 | 2026-11-06 |
| PoC in GitHub | lpizziniacofortinet/cve-2026-123158-openssh-musl-lab | 2026-11-06 |
| PoC in GitHub | mc493/openssh-musl-enterprise--hardening-cve-2026-123158 | 2026-11-06 |
| PoC in GitHub | mlazzarotto/ansible-sshole-remediate | 2026-11-06 |
| PoC in GitHub | shenxianpeng/check-sshole | 2026-11-06 |
| PoC in GitHub | techdevfun/alpinegate | 2026-11-06 |
| PoC in GitHub | techtaek77/sshole-guide | 2026-11-06 |
| PoC in GitHub | MikeCase/check-sshole | 2026-11-07 |
| PoC in GitHub | liamromanis101/MaSSHole | 2026-11-07 |
| PoC in GitHub | Galaxy-sc/CVE-2026-123158 | 2026-11-08 |
| PoC in GitHub | GarphenGate/cve-2026-123158-defender-toolkit | 2026-11-08 |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploits_more | PoC in GitHub | |
| exploits_more | PoC in GitHub | |
| affected | OSV | |
| exploits_more | PoC in GitHub | |
| references | NVD | |
| references | GitHub Advisories, NVD, OSV | |
| references | OSV | |
| references | OSV | |
| references | CVE List | |
| references | NVD |
Show 25 moreShow less
| Recorded | Changed | Sources |
|---|---|---|
| references | GitHub Advisories | |
| exploitation | EUVD | |
| exploits, exploits_more | PoC in GitHub | |
| references | CVE List | |
| exploitation, facts, kev | CISA KEV | |
| affected, aliases, references | OSV | |
| references | OSV | |
| exploits | PoC in GitHub | |
| affected | EUVD, GitHub Advisories, NVD, OSV | |
| references | CVE List | |
| exploits | PoC in GitHub | |
| affected, aliases, references | OSV | |
| affected, aliases, references | OSV | |
| affected, aliases, references | OSV | |
| exploits, facts | OSV, PoC in GitHub | |
| affected, aliases, facts, references | OSV | |
| references | CVE List, EUVD, NVD, OSV | |
| references | CVE List, EUVD | |
| references | OSV | |
| references | EUVD, GitHub Advisories, NVD | |
| aliases, references, title | GitHub Advisories | |
| references | CVE List | |
| aliases, published | EUVD | |
| references | CVE List | |
| first indexed | CVE List |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-123158 is a high vulnerability (CVSS 8.1) in Openbsd Openssh, published November 5, 2026. CISA lists it as known to be exploited, since November 9, 2026. EUVD reports exploitation since November 9, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 18.9%, the 97th percentile. Fixed in openssh 9.0_p1-r6.
References
openssh.org/releasenotes.html
github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482
news.ycombinator.com/item?id=50377976
marc.info?l=openssh-unix-dev&m=179388064263131&w=2
hachyderm.io/@damienmiller/117563026759098135
Show 22 moreShow less
alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass
openwall.com/lists/oss-security/2026/11/09/27
sshhole.com
sshole.events.greynoise.io
isc.sans.edu/diary.html?storyid=33498
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-123158
nvd.nist.gov/vuln/detail/CVE-2026-123158
security.alpinelinux.org/vuln/CVE-2026-123158
docs.bell-sw.com/security/cves/CVE-2026-123158
security-tracker.debian.org/tracker/CVE-2026-123158
ubuntu.com/security/CVE-2026-123158
cve.org/CVERecord?id=CVE-2026-123158
Left out here: 29 versions. The JSON record has them. The full exploit list has 9 more links.