CVE-2026-123158: High severity vulnerability

Published Nov 5, 2026

Updated

sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OpenSSH to a version that resolves this vulnerability.
Fixed in 10.6p2

Event History

Nov 5, 2026

CVE Published

via MITRE·03:46 PM

Data Sourced

via MITRE·03:46 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which systems are exposed to this issue?

The affected condition is OpenSSH sshd before 10.6p2 on Linux systems using musl libc without PAM. Alpine Linux is an example platform that can use this combination; exposure also depends on the configuration of individual accounts.

What does an attacker need to exploit it?

An attacker can attempt password authentication remotely without prior authentication or user interaction. Exploitation requires targeting an account whose configuration is affected and submitting a password between 256 and 1024 characters.

Are all password-authenticated accounts affected?

No. The issue affects only some account configurations because it is related to how sshd interprets whether a string is intended to be a password hash. The provided information does not identify the specific account configurations that are vulnerable.

How can I mitigate the issue if I cannot upgrade immediately?

The provided data identifies the affected condition as musl libc without PAM and password authentication. It does not provide a validated temporary mitigation or configuration workaround.

CVE-2026-123158: High severity vulnerability

Remediation

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker need to exploit it?

Are all password-authenticated accounts affected?

How can I mitigate the issue if I cannot upgrade immediately?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker need to exploit it?

Are all password-authenticated accounts affected?

How can I mitigate the issue if I cannot upgrade immediately?