{"id":"CVE-2026-123158","aliases":["ALPINE-CVE-2026-123158","AZL-112871","BELL-CVE-2026-123158","DEBIAN-CVE-2026-123158","EUVD-2026-117552","GHSA-4fcc-vm97-gx3x","UBUNTU-CVE-2026-123158"],"status":"published","title":"sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround...","description":"sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.189,"percentile":0.97335,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-394"],"published":"2026-11-05T15:46:26Z","modified":"2026-11-12T07:04:10Z","kev":{"date_added":"2026-11-09","due_date":"2026-11-12","required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2026-11-09"},{"source":"kev","since":"2026-11-09"}],"exploits":[{"source":"pocgithub","id":"The-DevOps-Daily/alpine-sshd-check","title":"The-DevOps-Daily/alpine-sshd-check","date":"2026-11-05","url":"https://github.com/The-DevOps-Daily/alpine-sshd-check"},{"source":"pocgithub","id":"ashrafzaryouh/CVE-2026-123158","title":"ashrafzaryouh/CVE-2026-123158","date":"2026-11-05","url":"https://github.com/ashrafzaryouh/CVE-2026-123158"},{"source":"pocgithub","id":"coboliqcom/cve-2026-123158-sshole-safe-rust","title":"coboliqcom/cve-2026-123158-sshole-safe-rust","date":"2026-11-05","url":"https://github.com/coboliqcom/cve-2026-123158-sshole-safe-rust"},{"source":"pocgithub","id":"ersinkoc/sshole-check","title":"ersinkoc/sshole-check","date":"2026-11-05","url":"https://github.com/ersinkoc/sshole-check"},{"source":"pocgithub","id":"gabrielunknown/CVE-2026-123158_SSHole","title":"gabrielunknown/CVE-2026-123158_SSHole","date":"2026-11-05","url":"https://github.com/gabrielunknown/CVE-2026-123158_SSHole"},{"source":"pocgithub","id":"rothoma2/cve-2026-123158-sshole","title":"rothoma2/cve-2026-123158-sshole","date":"2026-11-05","url":"https://github.com/rothoma2/cve-2026-123158-sshole"},{"source":"pocgithub","id":"CriticalWombat/sshole_scanner-CVE-2026-123158","title":"CriticalWombat/sshole_scanner-CVE-2026-123158","date":"2026-11-06","url":"https://github.com/CriticalWombat/sshole_scanner-CVE-2026-123158"},{"source":"pocgithub","id":"Funcan/sshole","title":"Funcan/sshole","date":"2026-11-06","url":"https://github.com/Funcan/sshole"},{"source":"pocgithub","id":"HackSpeak/CVE-2026-123158","title":"HackSpeak/CVE-2026-123158","date":"2026-11-06","url":"https://github.com/HackSpeak/CVE-2026-123158"},{"source":"pocgithub","id":"Hel1um17/sshole-bypass-openssh-password","title":"Hel1um17/sshole-bypass-openssh-password","date":"2026-11-06","url":"https://github.com/Hel1um17/sshole-bypass-openssh-password"},{"source":"pocgithub","id":"Maalfer/CVE-2026-123158","title":"Maalfer/CVE-2026-123158","date":"2026-11-06","url":"https://github.com/Maalfer/CVE-2026-123158"},{"source":"pocgithub","id":"akarkode/alpine-openssh-sshole-auth-bypass","title":"akarkode/alpine-openssh-sshole-auth-bypass","date":"2026-11-06","url":"https://github.com/akarkode/alpine-openssh-sshole-auth-bypass"},{"source":"pocgithub","id":"ansonhsu-ai/sshhole-cve-2026-123158-ste","title":"ansonhsu-ai/sshhole-cve-2026-123158-ste","date":"2026-11-06","url":"https://github.com/ansonhsu-ai/sshhole-cve-2026-123158-ste"},{"source":"pocgithub","id":"crash00xd/CVE-2026-123158_SSHRole_PoC","title":"crash00xd/CVE-2026-123158_SSHRole_PoC","date":"2026-11-06","url":"https://github.com/crash00xd/CVE-2026-123158_SSHRole_PoC"},{"source":"pocgithub","id":"halilkirazkaya/CVE-2026-123158","title":"halilkirazkaya/CVE-2026-123158","date":"2026-11-06","url":"https://github.com/halilkirazkaya/CVE-2026-123158"},{"source":"pocgithub","id":"lpizziniacofortinet/cve-2026-123158-openssh-musl-lab","title":"lpizziniacofortinet/cve-2026-123158-openssh-musl-lab","date":"2026-11-06","url":"https://github.com/lpizziniacofortinet/cve-2026-123158-openssh-musl-lab"},{"source":"pocgithub","id":"mc493/openssh-musl-enterprise--hardening-cve-2026-123158","title":"mc493/openssh-musl-enterprise--hardening-cve-2026-123158","date":"2026-11-06","url":"https://github.com/mc493/openssh-musl-enterprise--hardening-cve-2026-123158"},{"source":"pocgithub","id":"mlazzarotto/ansible-sshole-remediate","title":"mlazzarotto/ansible-sshole-remediate","date":"2026-11-06","url":"https://github.com/mlazzarotto/ansible-sshole-remediate"},{"source":"pocgithub","id":"shenxianpeng/check-sshole","title":"shenxianpeng/check-sshole","date":"2026-11-06","url":"https://github.com/shenxianpeng/check-sshole"},{"source":"pocgithub","id":"techdevfun/alpinegate","title":"techdevfun/alpinegate","date":"2026-11-06","url":"https://github.com/techdevfun/alpinegate"},{"source":"pocgithub","id":"techtaek77/sshole-guide","title":"techtaek77/sshole-guide","date":"2026-11-06","url":"https://github.com/techtaek77/sshole-guide"},{"source":"pocgithub","id":"MikeCase/check-sshole","title":"MikeCase/check-sshole","date":"2026-11-07","url":"https://github.com/MikeCase/check-sshole"},{"source":"pocgithub","id":"liamromanis101/MaSSHole","title":"liamromanis101/MaSSHole","date":"2026-11-07","url":"https://github.com/liamromanis101/MaSSHole"},{"source":"pocgithub","id":"Galaxy-sc/CVE-2026-123158","title":"Galaxy-sc/CVE-2026-123158","date":"2026-11-08","url":"https://github.com/Galaxy-sc/CVE-2026-123158"},{"source":"pocgithub","id":"GarphenGate/cve-2026-123158-defender-toolkit","title":"GarphenGate/cve-2026-123158-defender-toolkit","date":"2026-11-08","url":"https://github.com/GarphenGate/cve-2026-123158-defender-toolkit"}],"exploits_more":9,"fixes":[{"ecosystem":"Alpine:v3.16","package":"openssh","fixed_in":["9.0_p1-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"openssh","fixed_in":["9.1_p1-r7"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"openssh","fixed_in":["9.3_p2-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"openssh","fixed_in":["9.6_p1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"openssh","fixed_in":["9.7_p1-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"openssh","fixed_in":["9.9_p2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"openssh","fixed_in":["10.0_p1-r11"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"openssh","fixed_in":["10.2_p1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"openssh","fixed_in":["10.3_p1-r2"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"openssh","fixed_in":["9.1_p1-r17"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"openssh","fixed_in":["10.6_p2-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"openssh","fixed_in":["10.6_p2-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"openssh","fixed_in":["9.1_p1-r17"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"openssh","fixed_in":["10.6_p2-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"openssh","fixed_in":["10.6_p2-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openssh","fixed_in":["1:10.6p2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openssh-gssapi","fixed_in":["1:10.6p2-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.16","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0_p1-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1_p1-r7"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3_p2-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6_p1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.7_p1-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.9_p2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0_p1-r11"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2_p1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.3_p1-r2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"9.8p1-10"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.1_p1-r3"},{"fixed":"9.1_p1-r17"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0_p1-r7"},{"fixed":"10.6_p2-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0_p1-r7"},{"fixed":"10.6_p2-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.1_p1-r3"},{"fixed":"9.1_p1-r17"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0_p1-r7"},{"fixed":"10.6_p2-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0_p1-r7"},{"fixed":"10.6_p2-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.0p1-1","1:10.0p1-2","1:10.0p1-3","1:10.0p1-4","1:10.0p1-5","1:10.0p1-5~bpo12+2","1:10.0p1-6","1:10.0p1-7","1:10.0p1-7~bpo12+1","1:10.0p1-8","1:10.1p1-1","1:10.1p1-2","1:10.2p1-1","1:10.2p1-2","1:10.2p1-2~bpo13+1","1:10.2p1-3","1:10.2p1-4","1:10.2p1-5","1:10.2p1-6","1:10.2p1-6~bpo13+1","1:10.3p1-1","1:10.3p1-1~bpo13+1","1:10.3p1-2","1:10.3p1-3","1:10.3p1-4","1:10.3p1-5","1:10.3p1-7","1:10.3p1-8","1:10.3p1-9","1:10.4p1-1","1:10.4p1-2","1:10.4p1-3","1:10.4p1-4","1:10.4p1-5","1:10.5p1-1","1:10.6p1-1","1:10.6p2-1","1:9.2p1-2","1:9.2p1-2+deb12u1","1:9.2p1-2+deb12u10","1:9.2p1-2+deb12u2","1:9.2p1-2+deb12u3","1:9.2p1-2+deb12u4","1:9.2p1-2+deb12u5","1:9.2p1-2+deb12u6","1:9.2p1-2+deb12u7","1:9.2p1-2+deb12u8","1:9.2p1-2+deb12u9","1:9.3p1-1","1:9.3p1-1+loong64","1:9.3p2-1","1:9.4p1-1","1:9.5p1-1","1:9.5p1-2","1:9.6p1-1","1:9.6p1-2","1:9.6p1-3","1:9.6p1-4","1:9.6p1-5","1:9.7p1-1","1:9.7p1-2","1:9.7p1-3","1:9.7p1-3+hurd.1","1:9.7p1-4","1:9.7p1-5","1:9.7p1-6","1:9.7p1-7","1:9.8p1-1","1:9.8p1-2","1:9.8p1-3","1:9.8p1-4","1:9.8p1-7","1:9.8p1-8","1:9.9p1-1","1:9.9p1-2","1:9.9p1-3","1:9.9p1-3+hurd.1","1:9.9p2-1","1:9.9p2-2"]},{"source":"osv","ecosystem":"Debian:13","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.0p1-7","1:10.0p1-7+deb13u1","1:10.0p1-7+deb13u2","1:10.0p1-7+deb13u3","1:10.0p1-7+deb13u4","1:10.0p1-8","1:10.1p1-1","1:10.1p1-2","1:10.2p1-1","1:10.2p1-2","1:10.2p1-2~bpo13+1","1:10.2p1-3","1:10.2p1-4","1:10.2p1-5","1:10.2p1-6","1:10.2p1-6~bpo13+1","1:10.3p1-1","1:10.3p1-1~bpo13+1","1:10.3p1-2","1:10.3p1-3","1:10.3p1-4","1:10.3p1-5","1:10.3p1-7","1:10.3p1-8","1:10.3p1-9","1:10.4p1-1","1:10.4p1-2","1:10.4p1-3","1:10.4p1-4","1:10.4p1-5","1:10.5p1-1","1:10.6p1-1","1:10.6p2-1"]},{"source":"osv","ecosystem":"Debian:14","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.6p2-1"}]}],"versions":["1:10.0p1-7","1:10.0p1-8","1:10.1p1-1","1:10.1p1-2","1:10.2p1-1","1:10.2p1-2","1:10.2p1-2~bpo13+1","1:10.2p1-3","1:10.2p1-4","1:10.2p1-5","1:10.2p1-6","1:10.2p1-6~bpo13+1","1:10.3p1-1","1:10.3p1-1~bpo13+1","1:10.3p1-2","1:10.3p1-3","1:10.3p1-4","1:10.3p1-5","1:10.3p1-7","1:10.3p1-8","1:10.3p1-9","1:10.4p1-1","1:10.4p1-2","1:10.4p1-3","1:10.4p1-4","1:10.4p1-5","1:10.5p1-1","1:10.6p1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"openssh-gssapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.6p2-1"}]}],"versions":["1:10.4p1-5","1:10.5p1-1","1:10.6p1-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-8","1:7.5p1-9","1:7.5p1-9build1","1:7.5p1-10"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-11build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-12","1:7.5p1-12build1","1:7.5p1-13"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-14","1:7.5p1-15","1:7.5p1-15build1","1:7.5p1-16"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-18","1:7.5p1-18ubuntu1","1:7.5p1-18ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-17","1:7.5p1-18"]}],"products":[{"vendor":"openbsd","product":"openssh"}],"references":[{"url":"https://www.openssh.org/releasenotes.html#10.6p2","tags":["Release Notes","web","report"]},{"url":"https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482","tags":["Patch","fix","report"]},{"url":"https://news.ycombinator.com/item?id=50377976","tags":["Issue Tracking","web","report"]},{"url":"https://news.ycombinator.com/item?id=50378228","tags":["Issue Tracking","web","report"]},{"url":"https://marc.info/?l=openssh-unix-dev\u0026m=179388064263131\u0026w=2","tags":["Mailing List","Vendor Advisory","web","report"]},{"url":"https://hachyderm.io/@damienmiller/117563026759098135","tags":["Third Party Advisory","web","report"]},{"url":"https://github.com/predkambrij/sshhole-repro","tags":["Exploit","Third Party Advisory","package","report"]},{"url":"https://github.com/leonjza/sshhole-lab","tags":["Exploit","Third Party Advisory","package","report"]},{"url":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/","tags":["Third Party Advisory","web","report"]},{"url":"https://news.ycombinator.com/item?id=50379704","tags":["Issue Tracking","web","report"]},{"url":"https://github.com/google/goonami-scanner/pull/277","tags":["Third Party Advisory","fix","report"]},{"url":"https://github.com/coollabsio/coolify/discussions/12484","tags":["Third Party Advisory","web"]},{"url":"https://github.com/panubo/docker-sshd/issues/93","tags":["Third Party Advisory","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/11/09/27","tags":["Mailing List","web"]},{"url":"https://sshhole.com","tags":["exploit","technical-description","Third Party Advisory","evidence","report"]},{"url":"https://sshole.events.greynoise.io/","tags":["third-party-advisory","Third Party Advisory","advisory"]},{"url":"https://isc.sans.edu/diary.html?storyid=33498","tags":["third-party-advisory","Not Applicable","advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-123158","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123158","tags":["web","advisory"]},{"url":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass"},{"url":"https://sshole.events.greynoise.io"},{"url":"https://github.com/advisories/GHSA-4fcc-vm97-gx3x"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-123158","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-123158","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-123158.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-123158","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-123158","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-123158","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/11/05/3","tags":["report"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-123158","description":"sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.","status":"published","published":"2026-11-05T15:46:26.488Z","modified":"2026-11-10T04:55:54.758Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-394"],"updated_at":"2026-11-10T01:35:56.410062Z"}],"euvd":[{"id":"EUVD-2026-117552","description":"sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.","status":"published","published":"2026-11-05T15:46:26Z","modified":"2026-11-10T04:55:54Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"exploited_since":"2026-11-09","updated_at":"2026-11-09T18:17:40.212453Z"}],"ghsa":[{"id":"GHSA-4fcc-vm97-gx3x","title":"sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround...","description":"sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.","status":"published","published":"2026-11-05T18:33:14Z","modified":"2026-11-10T03:30:24Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-394"],"updated_at":"2026-11-10T03:51:51.547106Z"}],"kev":[{"id":"CVE-2026-123158","title":"OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability","description":"OpenBSD OpenSSH on Linux contains an unexpected status code or return value vulnerability that could allow for authentication bypass.","cwes":["CWE-394"],"kev":{"date_added":"2026-11-09","due_date":"2026-11-12","required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-09T17:08:36.530222Z"}],"nvd":[{"id":"CVE-2026-123158","description":"sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.","status":"published","published":"2026-11-05T16:17:47.11Z","modified":"2026-11-10T13:48:52.11Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-394"],"updated_at":"2026-11-10T16:19:50.369963Z"}],"osv":[{"id":"ALPINE-CVE-2026-123158","description":"sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.","status":"published","published":"2026-11-05T16:17:47.11Z","modified":"2026-11-06T11:30:02.98742755Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-06T11:42:45.055937Z"},{"id":"BELL-CVE-2026-123158","status":"published","published":"2026-11-06T09:20:51.701884Z","modified":"2026-11-07T07:15:02.307404758Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-07T07:40:28.517244Z"},{"id":"CVE-2026-123158","description":"sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.","status":"published","published":"2026-11-05T15:46:26.488Z","modified":"2026-11-12T07:04:10.990012518Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-394"],"updated_at":"2026-11-10T10:57:25.458985Z"},{"id":"DEBIAN-CVE-2026-123158","description":"sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.","status":"published","published":"2026-11-05T16:17:47.11Z","modified":"2026-11-11T09:47:33.297718898Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-08T17:07:41.883129Z"},{"id":"UBUNTU-CVE-2026-123158","description":"sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.","status":"published","published":"2026-11-06T00:00:00Z","modified":"2026-11-11T09:39:21.06883481Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-11T10:01:18.620522Z"},{"id":"AZL-112871","title":"CVE-2026-123158 affecting package openssh 9.8p1-10","description":"sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.","status":"published","published":"2026-11-05T16:17:47Z","modified":"2026-11-09T14:17:47.394134925Z","updated_at":"2026-11-09T15:02:02.69266Z"}]}}