Okta says platform not affected by OpenSSH SSHole flaw
Original title: OpenSSH "SSHole" Vulnerability (CVE-2026-123158)
Okta says CVE-2026-123158 needs configurations it does not use and that admin access is not on the public internet.
On November 12, 2026, Okta said its security team reviewed a recent OpenSSH advisory for the flaw dubbed SSHole, CVE-2026-123158, and concluded the Okta platform is not affected. The company said exploitation depends on configurations absent from its environment and that administrative access is not exposed to the public internet.
- Okta published the statement on November 12, 2026.
- The company cites missing configurations and no public admin access.
- The note does not describe the OpenSSH flaw’s technical impact.
| Product | Affected |
|---|---|
| OpenSSH | — |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-123158 | Password bypass in OpenSSH before 10.6p2 on musl without PAM | 8.1 | 19% | KEVPoC ×18 | KEV |
From the original article
1 min read at sec.okta.com
Okta’s Response Our security team has reviewed the recent OpenSSH advisory and confirmed that our platform is not affected. Exploitation relies on specific configurations that are not present in our environment, and administrative access is not expos ...
sec.okta.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.