CVE-2026-123158Not scored
CVE-2026-123158: OpenSSH vulnerability
Fixed in 10.6p2 · Affected: OpenSSH before 10.6p2 · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.04 (4 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
No EPSS score yet. The score appears once FIRST publishes it.
Not scored yet. NVD has not published a CVSS score.
DescriptionNVD
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
What changed
- CyberSIXT updated “OpenSSH flaw lets any long password into key-only Alpine accounts” CyberSIXT
Coverage1 article · 1 outlet
First in our coverage: cybersixt, 5 Nov.
- OpenSSH flaw lets any long password into key-only Alpine accountscybersixt · first in our coverage
New articles also arrive in the RSS feed.