Exploited OpenSSH flaw CVE-2026-123158 lets long passwords bypass sign-in on musl Linux
On Alpine Linux and other musl systems with PAM disabled, some accounts accept any password between 256 and 1024 characters. OpenSSH places the root cause outside sshd but has shipped a workaround in sshd itself.
Affects
OpenSSH
What to do
Upgrade sshd to OpenSSH 10.6p2 on every musl Linux host now, or turn off password sign-in until you do.
- KEV listed
- CVE
- CVE-2026-123158
- CVSS
- 8.1 (v3.1, MITRE)
- Exploitation
- Exploited, in the CISA catalogue
- Affected
- OpenSSH before 10.6p2 on Linux with musl libc and PAM disabled
- Fixed in
- Portable OpenSSH 10.6p2
How the flaw works
The flaw sits in password authentication in sshd on Linux systems that use musl libc with PAM disabled. sshd misreads whether a string is meant to be a password hash, so for some account configurations any password between 256 and 1024 characters succeeds. An attacker who can reach the SSH port signs in as that account without knowing its password.
What to do now
Musl hosts that take SSH passwords from the internet go first, because the bypass needs only network reach to sshd with password sign-in enabled.
- List every host and container image that runs sshd on Alpine or another musl distribution
- Upgrade sshd to the fixed OpenSSH release, or a distribution package that includes the workaround, and restart sshd
- Where the upgrade must wait, set PasswordAuthentication no in sshd_config and restart sshd, so only keys sign in
- Rebuild container images once the base image carries OpenSSH 10.6p2; until then turn off password sign-in in sshd_config
- Rotate passwords and SSH keys on any host with an unexplained sign-in
Who is affected
Alpine Linux is the example NVD gives of a platform using musl libc without PAM. OpenSSH says it affects some Linux systems built and run with PAM support disabled. Exposure runs through password authentication in sshd, so hosts and Alpine-based container images that accept password sign-in are the ones in scope.
Detection notes
A successful bypass shows in the sshd log as an ordinary accepted password sign-in, because the long password succeeds. Review accepted password sign-ins on each affected host and Alpine-based container from 5 November onwards, and earlier where logs allow.
- Password sign-ins to accounts that normally use only SSH keys
- Successful sign-ins from addresses outside the admin network or VPN range
- New accounts, SSH keys or scheduled jobs nobody on the team added
Essential Eight mapping
Patch applications and patch operating systems: the Essential Eight Maturity Model sets 48 hours for internet-facing services when the vendor rates a flaw critical or a working exploit exists. OpenSSH calls its fix critical and the flaw is exploited, so both triggers apply.
Sources
- PrimaryCISA, Known Exploited Vulnerabilities Catalog (release 2026.11.09)Retrieved 10 Nov 2026
- PrimaryOpenSSH, Release notes: OpenSSH 10.6p2 (5 November 2026)Retrieved 10 Nov 2026
- PrimaryNVD, CVE-2026-123158 detail (published 5 November 2026)Retrieved 10 Nov 2026
- PrimaryASD, Essential Eight Maturity ModelRetrieved 29 Oct 2026
