CVE-2026-123158

Published Nov 5, 2026

Last updated 29 minutes ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-123158, nicknamed "sshole," is a password authentication bypass vulnerability affecting OpenSSH (`sshd`) on Linux systems that use the musl C library (musl libc) without Pluggable Authentication Modules (PAM). Discovered by researcher Özgün Kültekin and patched in OpenSSH version 10.6p2 on November 5, 2026, the flaw primarily impacts Alpine Linux, where this specific configuration is the default. It also potentially affects other musl-based environments such as OpenWrt, Buildroot, Yocto, and various lightweight Docker container images. The vulnerability occurs due to an unexpected interaction between OpenSSH's password validation and musl's `crypt()` function. When an attacker attempts to log in using an overlong password (typically between 257 and 1,024 bytes), the `crypt()` function fails and returns an asterisk ("*"). If the target account is passwordless and has its password field in `/etc/shadow` set to "*", OpenSSH compares the two matching values and mistakenly grants access. This allows remote attackers to log into these accounts without knowing any valid credentials, which can lead to unauthorized access and potential privilege escalation.

Description: sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
Source: cve@mitre.org
NVD status: Analyzed
Products: openssh

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8.1
Impact score: 5.9
Exploitability score: 2.2
Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Known exploits

Data from CISA

Vulnerability name: OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability
Exploit added on: Nov 9, 2026
Exploit action due: Nov 12, 2026
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Weaknesses

cve@mitre.org: CWE-394

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "09209468-5A53-45C0-8698-8C668E53EBEA",
            "versionEndExcluding": "10.6",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:openbsd:openssh:10.6:-:*:*:*:*:*:*",
            "matchCriteriaId": "4C93748B-FD1E-4BD4-9D18-0D4D2BD9C518",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:openbsd:openssh:10.6:p1:*:*:*:*:*:*",
            "matchCriteriaId": "AD8BE997-294C-4E7A-A714-6FCED9884258",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      },
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:alpinelinux:alpine_linux:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "70B1C408-9879-44A0-ADA0-5E0B0B3447EA",
            "versionEndExcluding": "3.21.10",
            "vulnerable": false
          },
          {
            "criteria": "cpe:2.3:o:alpinelinux:alpine_linux:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "D4963B56-DEDA-43CE-B636-6715C4C3C1EE",
            "versionEndExcluding": "3.22.8",
            "versionStartIncluding": "3.22.0",
            "vulnerable": false
          },
          {
            "criteria": "cpe:2.3:o:alpinelinux:alpine_linux:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "3C30A060-F2D9-4A44-A839-7CE86E222A88",
            "versionEndExcluding": "3.23.8",
            "versionStartIncluding": "3.23.0",
            "vulnerable": false
          },
          {
            "criteria": "cpe:2.3:o:alpinelinux:alpine_linux:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "3A5F114B-8B24-43BB-AF9C-F2AB8A12F3B0",
            "versionEndExcluding": "3.24.4",
            "versionStartIncluding": "3.24.0",
            "vulnerable": false
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "AND"
  }
]

References

Sources include official advisories and independent security research.