CVE-2026-123158: OpenSSH musl auth bypass enables RCE
Exploitation confirmed in the wild for musl-based OpenSSH before 10.6p2; fixed in 10.6p2 with Alpine backports.
85
CVE-2026-123158
Password bypass in OpenSSH before 10.6p2 on musl without PAM
- CVSS 3.1
- 8.1 high
- EPSS
- 1%p63
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, can misinterpret whether a string is a password hash. A remote, unauthenticated attacker can log in to some account configurations by sending any password of 256 to 1024 characters. That grants the privileges of the targeted account. Alpine Linux is an example of this setup.
What to do: Upgrade OpenSSH to 10.6p2. No workaround is stated.
| Product | Affected | Fixed in |
|---|---|---|
| OpenSSH | before 10.6p2 | 10.6p2 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
- Weakness
- CWE-394
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news
10 storiesAttackers exploit OpenSSH SSHole auth bypass on musl Linux (CVE-2026-123158)New
GreyNoise logged 16 successful chains from six IPs after the 10.6p2 fix; one install of TAC Agent never reached its C2.
82
OpenSSH sshole flaw exploited in the wild hours after disclosure (CVE-2026-123158)
Previdian detected successful root access on an Alpine Linux honeypot within hours of disclosure.
80
Hackers Exploit SSHole Authentication Bypass in OpenSSH (CVE-2026-123158)
Attackers supply any password 257-1024 characters long to bypass authentication on Alpine and musl-based Linux systems.
75
Hackers Exploit OpenSSH SSHole Flaw Within Hours of Disclosure
Attackers gain root access on Alpine Linux honeypot via CVE-2026-123158; patch released in OpenSSH 10.6p2
75
Weekly recap: OpenSSH SSHole probed, Zyxel zero-day hits switches
Twenty OpenSSH attempts came from 13 IPs, and a Zyxel flaw was used on nearly 1,000 switches.
74
OpenSSH Patches SSHole Authentication Bypass
CVE-2026-123158 lets attackers log in with passwords 257-1024 characters on Alpine Linux without PAM.
70
OpenSSH flaw allows access to password-disabled accounts on musl Linux
Attackers bypass authentication on Alpine Linux cloud images by sending long passwords; emergency fix in OpenSSH 10.6p2.
70
Scans for SSHole vulnerability (CVE-2026-123158) increase in honeypots
Honeypots report increase in SSH attacks for sshole starting November 1, with first exploits on November 5.
50
OpenSSH sshole Flaw Allows Login to Passwordless Accounts
OpenSSH sshole flaw lets attackers log into password-disabled accounts using 257-1024 character passwords on musl-based systems.
50