CVE-2026-123158: Password Authentication Bypass in OpenSSH on musl Linux

Summary

Parameter	Value
CVE ID	CVE-2026-123158
Alert Source	CISA KEV - Active Exploitation
CVE Publication Year	2026
Date Published	2026-11-09
Vendor	OpenBSD
Product	OpenSSH
CVSS Score	8.1 (high)
EPSS Score	1.0% (percentile: 63%)
CISA KEV	Yes - confirmed active exploitation
Ransomware	Not confirmed
Remediation Deadline	2026-11-12

Vulnerability Description

Source: NVD, CISA KEV, OpenSSH

A vulnerability in sshd from OpenSSH versions before 10.6p2, present only on Linux systems that use musl libc and do not use PAM (Alpine Linux is one example). sshd lacked a workaround for the behaviour of musl’s crypt(): when a password exceeds the length limit, crypt() returns a single * character instead of a hash — the same character that marks accounts with no password or with password login disabled in /etc/shadow. As a result, for some accounts (e.g. root, key-only accounts, LDAP accounts) any password between 256 and 1024 characters long is accepted.

The flaw allows a remote attacker to log in over SSH to an affected account without knowing its password. CISA has added it to the KEV catalog as actively exploited, and public lab environments demonstrating the attack exist. The OpenSSH team shipped 10.6p2 as an urgent release on 5 November 2026 and considers the root cause to be outside OpenSSH itself, while being best placed to work around it. Non-Linux systems, Linux/glibc systems and systems that authenticate passwords through PAM are not affected.

Required Actions

• Upgrade OpenSSH to 10.6p2 or later (or to a distribution package that includes the fix). CISA deadline for US federal agencies: 2026-11-12.
• Until upgraded, set PasswordAuthentication no in sshd_config on every affected system (the OpenSSH team’s recommendation) or disable SSH on that host.
• Inventory where sshd runs on musl-based Linux: Alpine Linux hosts and VMs, container images with sshd built on Alpine, and devices or appliances running embedded Linux (OpenWrt, Buildroot, Yocto). For vendor-managed devices, follow vendor advisories and firmware updates.
• Review sshd logs for successful password logins to accounts that should never accept them (root, key-only service accounts), especially from addresses outside the management network.

Who Is Affected?

The vulnerability affects OpenSSH (an OpenBSD project) before 10.6p2, but only in the configuration: Linux + musl libc + password authentication without PAM. Typically this means servers and containers based on Alpine Linux and network devices or appliances running embedded Linux. Servers running RHEL, Debian, Ubuntu and other glibc-based distributions are not affected. Risk is highest where the SSH port of an affected system is reachable from the internet or from a broad internal network.

Sources

• NVD - CVE-2026-123158
• CISA KEV Catalog
• OpenSSH 10.6p2 - release notes
• OpenSSH - workaround commit
• FIRST EPSS

---

Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.