CVE-2026-123158: OpenSSH musl auth bypass enables RCE
Original title: CVE-2026-123158 | OpenSSH musl Password Authentication Bypass & Remote Code Execution Vulnerability (*sshole)
Exploitation confirmed in the wild for musl-based OpenSSH before 10.6p2; fixed in 10.6p2 with Alpine backports.
OpenSSH sshd before 10.6p2 on Linux using musl libc without PAM allows authentication bypass. Attackers knowing an account name with no password can log in by sending a long password that musl normalizes to the same *. This enables remote command execution. Public PoCs exist and exploitation in the wild has been confirmed. Fixed in OpenSSH 10.6p2; Alpine provides backported packages for affected versions. MITRE rates CVSS 3.1 8.1 High.
- * in password field triggers bypass on musl
- PasswordAuthentication must be enabled
- Affects Alpine Linux 3.16-3.24 and edge, OpenWrt
- Fixed: OpenSSH 10.6p2; Alpine edge 10.6_p2-r0 and 3.24 10.3_p1-r2
- Mitigation: set PasswordAuthentication no
Impact: unauthenticated remote code execution as account user
- 1.Upgrade to OpenSSH 10.6p2
- 2.Set PasswordAuthentication no and restart sshd
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-123158 | Password bypass in OpenSSH before 10.6p2 on musl without PAM | 8.1 | 1% | PoC ×13 |
From the original article
2 min read at horizon3.ai
CVE-2026-123158, known as *sshole, is an OpenSSH sshd authentication bypass on Linux systems that use musl libc without PAM, including Alpine Linux in its default configuration.
By Horizon3 · horizon3.ai
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.