CVE-2026-123158: OpenSSH Password Bypass on musl Linux
High CVSS (8.1) vulnerability; prioritize internet-facing assets.
TL;DR
- CVE-2026-123158 is a CVSS 8.1 remote SSH password-authentication bypass involving OpenSSH, musl libc, and systems without PAM.
- Alpine Linux and other musl-based deployments with password authentication enabled are the primary concern.
- Public reproductions exist. CISA KEV does not list the CVE, but exposed systems should be patched urgently.
- If immediate patching is not possible, disable SSH password authentication and require key-based access.
Summary
CVE-2026-123158 is an OpenSSH password authentication bypass affecting sshd versions before 10.6p2 when the daemon runs on Linux with musl libc and PAM is not in use. Under susceptible account and configuration conditions, an attacker can submit an unusually long password and potentially authenticate to an account that should not accept password authentication.
The issue depends on configuration; it is not a universal OpenSSH bypass. Typical glibc-based Linux systems are not automatically affected by this specific flaw, and PAM-enabled deployments may avoid the vulnerable code path. Verify the libc implementation, OpenSSH build, PAM configuration, and SSH authentication settings rather than inferring exposure from the operating-system name alone.
For related defensive planning, review this incident response planning checklist before investigating potentially compromised hosts.
| Field | Assessment |
|---|---|
| CVE | CVE-2026-123158 |
| CVSS | 8.1, High |
| CVSS vector | Not exposed in the supplied NVD response; confirm directly in the NVD record |
| Attack vector | Network |
| Authentication required | No prior attacker authentication is required; SSH service access is required |
| Privileges required | None, based on the reported remote authentication-bypass impact |
| Affected software | OpenSSH sshd before 10.6p2 under affected musl/no-PAM conditions |
| Fixed upstream version | OpenSSH 10.6p2 |
| Patch available | Yes |
| CISA KEV status | Not listed as of the 2026-11-06 check |
| Public PoC | Yes, public lab and reproducer repositories are referenced |
The supplied research note does not provide the complete CVSS vector string. That omission matters because defenders should not reconstruct vector components from the score alone. Before publishing or importing the score into risk systems, confirm the authoritative vector in the NVD record.
Analyst’s Take: Treat this as a deployment-validation problem, not an OpenSSH-wide emergency. The highest-priority systems are internet-facing musl hosts running an affected package with password authentication enabled, especially where account password fields are intended to block login. The absence of a CISA KEV listing does not change that patching or disabling password authentication should come first.
Root Cause
The vulnerability results from an interaction between OpenSSH password-authentication handling, musl libc’s crypt() behavior, and account password fields that indicate no usable password is configured. In the vulnerable path, an unusually long password can produce a result that OpenSSH misinterprets when deciding whether the account’s stored password hash is valid.
The reported trigger is generally a password between approximately 257 and 1024 bytes, while the NVD description states a range of 256 to 1024 characters. Do not use the exact boundary as a defensive control. Attackers can test nearby lengths, encodings, and protocol-handling behavior. The practical issue is that a remote SSH client can send a very long password to a reachable service.
This is not a generic flaw in every OpenSSH deployment. The relevant combination includes:
- OpenSSH before
10.6p2 - musl libc
- No PAM
- Password authentication available
- Susceptible account metadata
A server using glibc or a PAM-mediated authentication path may not be vulnerable to this specific behavior, but that should be verified rather than assumed.
Technical Notes
The important execution path is the server-side password-authentication decision. A vulnerable deployment can incorrectly treat the result of password hashing as sufficient to permit authentication, even though the account’s password field should prevent password login.
The issue is especially relevant to minimal Linux systems, containers, appliances, and edge services where PAM may be omitted intentionally. Those environments often expose SSH for administration while relying on account fields, disabled passwords, or other local conventions to prevent password-based access.
Who’s Exposed
The directly affected software range is OpenSSH sshd before 10.6p2 on Linux systems using musl libc without PAM. Alpine Linux is the most prominent example because Alpine commonly uses musl and can run OpenSSH without PAM. Exposure additionally depends on whether password authentication is enabled or otherwise available and whether susceptible account password fields are present.
The following Alpine package versions contain fixes:
| Alpine branch | Fixed openssh package |
|---|---|
| edge | 10.6_p2-r0 |
| 3.24 | 10.3_p1-r2 |
| 3.23 | 10.2_p1-r1 |
| 3.22 | 10.0_p1-r11 |
| 3.21 | 9.9_p2-r1 |
| 3.20 | 9.7_p1-r6 |
| 3.19 | 9.6_p1-r3 |
| 3.18 | 9.3_p2-r4 |
| 3.17 | 9.1_p1-r7 |
| 3.16 | 9.0_p1-r6 |
Alpine identifies releases 3.21.10, 3.22.8, 3.23.8, and 3.24.4 as containing the fixed packages. Check the package version on each host and image rather than relying only on the distribution release label.
Technical Notes
Use local inspection to identify the libc implementation and running SSH package:
ldd --version 2>&1 | head -n 1
ssh -V
apk policy openssh 2>/dev/null
ps -ef | grep '[s]shd'
On Alpine, confirm whether PAM support and password authentication are configured:
grep -RniE '^(UsePAM|PasswordAuthentication|KbdInteractiveAuthentication|AuthenticationMethods)' \
/etc/ssh/sshd_config /etc/ssh/sshd_config.d 2>/dev/null
A result showing musl, an OpenSSH package below the applicable fixed version, no PAM configuration, and enabled password authentication should be treated as high priority for remediation.
Severity Breakdown
NVD assigns CVE-2026-123158 a CVSS score of 8.1, classified as High. The available research note identifies the attack as remotely reachable through SSH and describes an authentication bypass that can grant access without a valid password to susceptible accounts.
Because the complete vector string was not present in the supplied NVD response, the individual metric values should not be invented. In particular, the exact confidentiality, integrity, availability, scope, and user-interaction components require confirmation from the authoritative NVD record.
| Severity aspect | Practical interpretation |
|---|---|
| Base score | 8.1, High |
| Attack surface | A network-reachable SSH service |
| Authentication | The flaw targets password authentication and can bypass the expected password check |
| Attacker effort | A public SSH endpoint and a specially long password are the relevant prerequisites |
| Impact | Unauthorized access to susceptible accounts, followed by whatever privileges those accounts possess |
| Environmental dependency | musl libc, no PAM, vulnerable OpenSSH version, and susceptible account configuration |
Interpret the score alongside exposure. A host with SSH bound only to a management network and password authentication disabled presents less practical risk than an internet-facing Alpine server accepting password authentication. Conversely, a low-privilege account can still provide a foothold for credential theft, lateral movement, persistence, or privilege escalation.
Technical Notes
Do not use the CVSS score as proof that a system is vulnerable. Validate the deployment predicates directly:
# Identify whether the system uses musl
ldd --version 2>&1 | head -n 1
# Identify OpenSSH version
/usr/sbin/sshd -V 2>&1 | head -n 1
# Test effective SSH configuration for a representative connection
sshd -T | grep -Ei 'usepam|passwordauthentication|kbdinteractiveauthentication|authenticationmethods'
The upstream fixed version is OpenSSH 10.6p2. Distribution backports may use a lower-looking upstream version with a patched package revision, so package advisories and package changelogs remain authoritative for vendor builds.
Exploitation Status
A public proof of concept or reproducer is available. The NVD reference list includes leonjza/sshhole-lab and predkambrij/sshhole-repro, indicating that the behavior can be reproduced in a laboratory or test environment. Public reproduction material makes the vulnerability technically weaponizable and reduces the barrier to testing exposed SSH services.
CVE-2026-123158 is not listed in the CISA Known Exploited Vulnerabilities catalog as of the supplied 2026-11-06 check. There is no established CISA confirmation of exploitation, and reliable primary-source confirmation of active exploitation in the wild was not established from the sources reviewed. The correct status is: public PoC exists; active exploitation is not confirmed.
The absence of a KEV listing does not prove that exploitation has never occurred. It means only that CISA has not included the CVE in the catalog at the time checked. Internet-facing SSH services should not wait for KEV inclusion before mitigation, particularly where password authentication is enabled.
Technical Notes
Use the public repositories for controlled validation only. Do not run a reproducer against production systems or third-party infrastructure without authorization. A safe test plan should use an isolated Alpine VM or container, a non-production account, captured SSH logs, and a known vulnerable package version.
For threat hunting, prioritize successful SSH authentications involving accounts that normally have disabled or unusable passwords, especially where the source address is untrusted and the event is accompanied by unusual connection volume or long-input indicators.
Sources
The NVD record provides the CVE description, affected OpenSSH range, CVSS score, and references to the upstream patch and public reproductions:
- NVD: CVE-2026-123158
- OpenSSH upstream patch commit
- sshhole laboratory repository
- sshhole reproducer
- OpenSSH developer discussion
Alpine’s advisory supplies the branch-specific fixed package versions and affected-release remediation guidance:
CISA’s catalog is the source for KEV status. The supplied assessment found that CVE-2026-123158 was not listed at the time of checking:
Because the CVSS vector string was not exposed in the supplied NVD response, organizations should confirm the vector directly in the NVD record before using individual CVSS metrics for prioritization or reporting.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.
Detection Guidance
Detection should combine asset inventory, configuration assessment, and authentication-log review. Network telemetry can identify SSH services exposed beyond trusted management networks, while host inspection can establish whether the system uses musl and whether the running openssh package is fixed.
The most valuable authentication signal is a successful SSH login to an account that should not accept password authentication. Log formats vary by Alpine version, syslog implementation, and SSH configuration, so normalize the event text before creating a permanent detection. A single failed long-password attempt is not proof of exploitation, but a successful login under these conditions warrants immediate investigation.
Technical Notes
Search common SSH authentication logs for successful password logins and suspicious account activity:
grep -Ei 'sshd.*(Accepted password|Failed password|authentication failure|Invalid user)' \
/var/log/auth.log /var/log/secure /var/log/messages 2>/dev/null
A practical SIEM query pattern is:
process.name:sshd AND
(message:"Accepted password" OR message:"authentication failure") AND
(user.name IN ("root","daemon","bin","sys","sync","shutdown","halt","operator"))
Adapt the account list to local policy. The query is a triage pattern, not proof of CVE exploitation. Correlate with:
- Source IP reputation and geolocation
- Whether the account’s password field is disabled, empty, or otherwise nonstandard
- The SSH service’s exposure and listening address
- A subsequent shell, command execution, privilege change, or new session
- Host package state at the time of the event
Inspect account password-field state carefully and avoid exposing password hashes in centralized logs:
awk -F: '$2 ~ /^(!|\\*|$)/ {print $1 ":" $2}' /etc/passwd /etc/shadow 2>/dev/null
Limit access to the resulting output because /etc/shadow is sensitive. If suspicious authentication is identified, preserve logs, terminate unauthorized sessions, review shell history and process activity, and rotate credentials or invalidate access as appropriate.
Remediation Steps
The preferred remediation is to upgrade OpenSSH to 10.6p2 or a vendor package that explicitly contains the fix. On Alpine, update to the fixed package for the relevant branch rather than assuming that a current base image tag is sufficient. The fixed Alpine package versions are listed above, and the Alpine project identifies releases 3.21.10, 3.22.8, 3.23.8, and 3.24.4 as containing fixes.
After upgrading, verify both the installed package and the running daemon. A package update that does not restart or reload the service may leave the vulnerable process running until the next restart.
Technical Notes
For Alpine systems, use:
apk update
apk upgrade -U -a
apk info -v openssh
rc-service sshd restart
Use the service-management command appropriate to the host. Before restarting a remote SSH service, maintain an existing administrative session or ensure console access is available. Then verify the daemon and effective configuration:
/usr/sbin/sshd -V 2>&1 | head -n 1
sshd -t
sshd -T | grep -Ei 'usepam|passwordauthentication|kbdinteractiveauthentication'
If immediate patching is impossible, disable password authentication and require key-based access:
# /etc/ssh/sshd_config
PasswordAuthentication no
KbdInteractiveAuthentication no
Validate and reload:
sshd -t && rc-service sshd reload
Configuration directives can be overridden by included files or distribution defaults, so confirm the effective result with sshd -T. Ensure that administrators have tested key-based access before disabling passwords, and preserve a separate recovery path.
Additional remediation actions include:
- Identify all musl-based hosts and container images.
- Restrict SSH exposure with firewall or security-group rules.
- Remove unnecessary public SSH access.
- Review susceptible account configurations.
- Rotate credentials if unauthorized access is suspected.
- Rebuild container images from fixed Alpine packages.
- Review privileged accounts and SSH keys for unexpected changes.
If a vulnerable server was internet-facing and suspicious successful authentication occurred, treat the host as potentially compromised rather than assuming that patching alone removes attacker access.
Organizations handling multiple credentials may also benefit from a managed password solution such as 1Password, provided it aligns with their security and procurement requirements. A password manager does not remediate this vulnerability, but it can support credential rotation and stronger administrative access practices.