High severity8.1NVD Advisory· Published Nov 5, 2026· Updated Nov 5, 2026
CVE-2026-123158
CVE-2026-123158
Description
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: <10.6p2
Patches
Vulnerability mechanics
References
9- alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/nvd
- github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482nvd
- hachyderm.io/@damienmiller/117563026759098135nvd
- marc.infonvd
- news.ycombinator.com/itemnvd
- news.ycombinator.com/itemnvd
- news.ycombinator.com/itemnvd
- sshhole.comnvd
- www.openssh.org/releasenotes.htmlnvd
News mentions
0No linked articles in our index yet.