ALPINE-CVE-2026-123158: High severity alpine/openssh vulnerability

Q: Which systems are exposed to this issue?

Systems running OpenSSH before 10.6p2 on Linux are affected when they use musl libc without PAM. Alpine Linux is an example platform using this combination, but exposure also depends on the affected account configuration.

Q: What does an attacker need to exploit the password bypass?

The attacker does not need an existing account or user interaction. Exploitation requires attempting password authentication against an account with a susceptible configuration and supplying a password between 256 and 1024 characters.

Q: Are all password-authentication accounts affected?

No. The issue applies only to some account configurations; the provided information does not identify which specific account configurations are susceptible.

Q: What is the immediate mitigation if upgrading is not possible?

The provided data identifies password authentication as the affected mechanism, but does not provide a documented workaround. Restricting or disabling password authentication would avoid the described authentication path, where operationally feasible.

Published Nov 5, 2026

Updated

sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.

Affected Software

9 affected componentsFixes available

alpine/openssh<9.0_p1-r6

9.0_p1-r6

alpine/openssh<9.1_p1-r7

9.1_p1-r7

alpine/openssh<9.3_p2-r4

9.3_p2-r4

alpine/openssh<9.6_p1-r3

9.6_p1-r3

alpine/openssh<9.7_p1-r6

9.7_p1-r6

alpine/openssh<9.9_p2-r1

9.9_p2-r1

alpine/openssh<10.0_p1-r11

10.0_p1-r11

alpine/openssh<10.2_p1-r1

10.2_p1-r1

alpine/openssh<10.3_p1-r2

10.3_p1-r2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade alpine/openssh to a version that resolves this vulnerability.
Fixed in 9.0_p1-r6
Upgrade
Upgrade alpine/openssh to a version that resolves this vulnerability.
Fixed in 9.1_p1-r7
Upgrade
Upgrade alpine/openssh to a version that resolves this vulnerability.
Fixed in 9.3_p2-r4
Upgrade
Upgrade alpine/openssh to a version that resolves this vulnerability.
Fixed in 9.6_p1-r3
Upgrade
Upgrade alpine/openssh to a version that resolves this vulnerability.
Fixed in 9.7_p1-r6
Upgrade
Upgrade alpine/openssh to a version that resolves this vulnerability.
Fixed in 9.9_p2-r1
Upgrade
Upgrade alpine/openssh to a version that resolves this vulnerability.
Fixed in 10.0_p1-r11
Upgrade
Upgrade alpine/openssh to a version that resolves this vulnerability.
Fixed in 10.2_p1-r1
Upgrade
Upgrade alpine/openssh to a version that resolves this vulnerability.
Fixed in 10.3_p1-r2
Upgrade
Upgrade OpenSSH sshd to a version that resolves this vulnerability.
Fixed in 10.6p2

Event History

Nov 5, 2026

CVE Published

via OSV·04:17 PM

Data Sourced

via OSV·04:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are exposed to this issue?

Systems running OpenSSH before 10.6p2 on Linux are affected when they use musl libc without PAM. Alpine Linux is an example platform using this combination, but exposure also depends on the affected account configuration.

What does an attacker need to exploit the password bypass?

The attacker does not need an existing account or user interaction. Exploitation requires attempting password authentication against an account with a susceptible configuration and supplying a password between 256 and 1024 characters.

Are all password-authentication accounts affected?

No. The issue applies only to some account configurations; the provided information does not identify which specific account configurations are susceptible.

What is the immediate mitigation if upgrading is not possible?

The provided data identifies password authentication as the affected mechanism, but does not provide a documented workaround. Restricting or disabling password authentication would avoid the described authentication path, where operationally feasible.

ALPINE-CVE-2026-123158: High severity alpine/openssh vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker need to exploit the password bypass?

Are all password-authentication accounts affected?

What is the immediate mitigation if upgrading is not possible?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker need to exploit the password bypass?

Are all password-authentication accounts affected?

What is the immediate mitigation if upgrading is not possible?