OpenSSH sshd before 10.6p2 password auth bypass (musl libc)
CVE-2026-123158 Published on November 5, 2026
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
Vulnerability Analysis
CVE-2026-123158 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
Unexpected Status Code or Return Value
The software does not properly check when a function or operation returns a value that is legitimate for the function, but is not expected by the software.
Products Associated with CVE-2026-123158
Want to know whenever a new CVE is published for OpenBSD OpenSSH? stack.watch will email you.
Affected Versions
OpenBSD OpenSSH:- Before 10.6p2 is affected.