CVE-2026-123158
CVSS 8.1 HIGH: sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password…
Vulnerabilities & Exploits
OpenSSH released 10.6p2, and Alpine fixed packages for releases back to 3.16, addressing CVE-2026-123158 in specific musl-based configurations. The OpenSSH project says it has seen no attacks.
On affected systems, musl returns an asterisk when a password exceeds its 256-byte limit. OpenSSH can mistake that error for the asterisk stored on accounts that reject password logins. Exploitation requires password authentication to be enabled, OpenSSH to run without Pluggable Authentication Modules (PAM), and a password-disabled account alongside another account with a SHA-256 or SHA-512 password hash. An oversized password can then open the otherwise password-disabled account.
On affected Alpine cloud images, an alpine account with passwordless doas can turn that login into root access. Elsewhere, the impact follows the privileges of exposed key-only or service accounts—not simply whether direct root SSH is blocked.
9 sources · Nov 6
CVSS 8.1 HIGH: sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password…
INCIBE-CERT
Omisión de autenticación por contraseña en OpenSSH de Alpine Linux
Özgün Kültekin, de Wakefield, ha informado sobre una vulnerabilidad de severidad alta.
originalNCSC-NL Advisories
Kwetsbaarheid verholpen in OpenSSH door OpenSSH Project
Het OpenSSH project heeft een kwetsbaarheid verholpen in sshd van OpenSSH versies ouder dan 10.6p2.
originalRisky Biz News
OpenSSH auth bypass bug hits Alpine Linux, OperWRT
An OpenSSH authentication bypass bug hits Alpine Linux and OpenWRT, hackers attempt to raise fridge temperatures at French blood banks, a [Read More
originalPart of the PlainSec briefing for 2026-11-05
Every edition of this story: OpenSSH fixes musl flaw exposing passwordless accounts