OpenSSH Patches SSHole Authentication Bypass
Original title: OpenSSH Rushes Patches for ‘SSHole’ Authentication Bypass
CVE-2026-123158 lets attackers log in with passwords 257-1024 characters on Alpine Linux without PAM.
OpenSSH released emergency patches for SSHole flaw affecting sshd on musl libc systems with PAM disabled. Flaw allows authentication bypass using long passwords on accounts with no password set. Fixes included in OpenSSH 10.6p2. Alpine Linux urged immediate patching.
- Affects Alpine Linux 3.16-3.24 and edge.
- CVSS score 8.1 for CVE-2026-123158.
- Fixes in OpenSSH 10.6p2.
- Simple single-connection attack.
Impact: Authentication bypass with long passwords
| Product | Affected | Fixed in |
|---|---|---|
| OpenSSH sshd | 10.6p2 | 10.6p2 |
- 1.Upgrade to OpenSSH 10.6p2
- 2.Disable password authentication
- 3.Restart sshd
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-123158 | Password bypass in OpenSSH before 10.6p2 on musl without PAM | 8.1 | 1% | PoC ×13 |
From the original article
3 min read at securityweek.com
On Linux distributions using musl libc without PAM, some accounts accept any password between 257 and 1024 characters. The post OpenSSH Rushes Patches for ‘SSHole’ Authentication Bypass appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.