DEBIAN-CVE-2026-123158: Debian/openssh vulnerability
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenSSH sshdto a version that resolves this vulnerability.Fixed in 10.6p2
Event History
Frequently Asked Questions
Which deployments are exposed to this authentication bypass?
The issue affects OpenSSH before 10.6p2 on Linux only when it uses musl libc without PAM. Alpine Linux is an example of a platform with that combination; the data does not establish that typical PAM-enabled Debian configurations are affected.
What must an attacker do to exploit the issue?
The attacker must target an account whose configuration triggers the password-hash interpretation problem and attempt password authentication. For affected account configurations, any password with a length from 256 through 1024 characters can be accepted.
Is a default configuration affected?
The available data does not say whether the vulnerable conditions are present by default. Exposure depends on using musl libc, operating without PAM, running a version before 10.6p2, and having affected account configurations.