CVE-2026-123158 sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be...
HighCVSS 8.1
EPSS 18.9%
CISA KEV
added 2026-11-09 · due 2026-11-12
Exploited in the wild
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
CISA Known Exploited Vulnerability
- Date added
- 2026-11-09
- Due date (FCEB)
- 2026-11-12
- Ransomware use
- Unknown
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/openssh(Debian:12) | All versions | No fix listed |
| debian/openssh(Debian:14) | < 1:10.6p2-1 | 1:10.6p2-1 |
| debian/openssh(Debian:13) | All versions | No fix listed |
| debian/openssh-gssapi(Debian:14) | < 1:10.6p2-1 | 1:10.6p2-1 |
| OpenBSD openssh | < 10.6p2 | 10.6p2 |
| debian/openssh(Debian:12) | = 1:10.0p1-1 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.0p1-2 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.0p1-3 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.0p1-4 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.0p1-5 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.0p1-5~bpo12+2 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.0p1-6 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.0p1-7 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.0p1-7~bpo12+1 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.0p1-8 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.1p1-1 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.1p1-2 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.2p1-1 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.2p1-2 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.2p1-2~bpo13+1 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.2p1-3 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.2p1-4 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.2p1-5 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.2p1-6 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.2p1-6~bpo13+1 | No fix listed |
Show 145 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/openssh(Debian:12) | = 1:10.3p1-1 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.3p1-1~bpo13+1 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.3p1-2 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.3p1-3 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.3p1-4 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.3p1-5 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.3p1-7 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.3p1-8 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.3p1-9 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.4p1-1 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.4p1-2 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.4p1-3 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.4p1-4 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.4p1-5 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.5p1-1 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.6p1-1 | No fix listed |
| debian/openssh(Debian:12) | = 1:10.6p2-1 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.2p1-2 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.2p1-2+deb12u1 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.2p1-2+deb12u10 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.2p1-2+deb12u2 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.2p1-2+deb12u3 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.2p1-2+deb12u4 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.2p1-2+deb12u5 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.2p1-2+deb12u6 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.2p1-2+deb12u7 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.2p1-2+deb12u8 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.2p1-2+deb12u9 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.3p1-1 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.3p1-1+loong64 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.3p2-1 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.4p1-1 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.5p1-1 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.5p1-2 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.6p1-1 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.6p1-2 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.6p1-3 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.6p1-4 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.6p1-5 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.7p1-1 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.7p1-2 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.7p1-3 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.7p1-3+hurd.1 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.7p1-4 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.7p1-5 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.7p1-6 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.7p1-7 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.8p1-1 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.8p1-2 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.8p1-3 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.8p1-4 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.8p1-7 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.8p1-8 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.9p1-1 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.9p1-2 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.9p1-3 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.9p1-3+hurd.1 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.9p2-1 | No fix listed |
| debian/openssh(Debian:12) | = 1:9.9p2-2 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.0p1-7 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.0p1-7+deb13u1 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.0p1-7+deb13u2 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.0p1-7+deb13u3 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.0p1-7+deb13u4 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.0p1-8 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.1p1-1 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.1p1-2 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.2p1-1 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.2p1-2 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.2p1-2~bpo13+1 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.2p1-3 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.2p1-4 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.2p1-5 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.2p1-6 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.2p1-6~bpo13+1 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.3p1-1 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.3p1-1~bpo13+1 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.3p1-2 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.3p1-3 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.3p1-4 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.3p1-5 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.3p1-7 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.3p1-8 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.3p1-9 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.4p1-1 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.4p1-2 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.4p1-3 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.4p1-4 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.4p1-5 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.5p1-1 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.6p1-1 | No fix listed |
| debian/openssh(Debian:13) | = 1:10.6p2-1 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.0p1-7 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.0p1-8 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.1p1-1 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.1p1-2 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.2p1-1 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.2p1-2 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.2p1-2~bpo13+1 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.2p1-3 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.2p1-4 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.2p1-5 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.2p1-6 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.2p1-6~bpo13+1 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.3p1-1 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.3p1-1~bpo13+1 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.3p1-2 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.3p1-3 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.3p1-4 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.3p1-5 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.3p1-7 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.3p1-8 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.3p1-9 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.4p1-1 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.4p1-2 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.4p1-3 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.4p1-4 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.4p1-5 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.5p1-1 | No fix listed |
| debian/openssh(Debian:14) | = 1:10.6p1-1 | No fix listed |
| debian/openssh-gssapi(Debian:14) | = 1:10.4p1-5 | No fix listed |
| debian/openssh-gssapi(Debian:14) | = 1:10.5p1-1 | No fix listed |
| debian/openssh-gssapi(Debian:14) | = 1:10.6p1-1 | No fix listed |
| ubuntu/openssh(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/openssh-ssh1(Ubuntu:22.04) | All versions | No fix listed |
| alpine/openssh(Alpine:v3.16) | < 9.0_p1-r6 | 9.0_p1-r6 |
| alpine/openssh(Alpine:v3.17) | < 9.1_p1-r7 | 9.1_p1-r7 |
| alpine/openssh(Alpine:v3.18) | < 9.3_p2-r4 | 9.3_p2-r4 |
| alpine/openssh(Alpine:v3.19) | < 9.6_p1-r3 | 9.6_p1-r3 |
| alpine/openssh(Alpine:v3.20) | < 9.7_p1-r6 | 9.7_p1-r6 |
| alpine/openssh(Alpine:v3.21) | < 9.9_p2-r1 | 9.9_p2-r1 |
| alpine/openssh(Alpine:v3.22) | < 10.0_p1-r11 | 10.0_p1-r11 |
| alpine/openssh(Alpine:v3.23) | < 10.2_p1-r1 | 10.2_p1-r1 |
| alpine/openssh(Alpine:v3.24) | < 10.3_p1-r2 | 10.3_p1-r2 |
| ubuntu/openssh(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/openssh-ssh1(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/openssh(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/openssh-ssh1(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/openssh(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/openssh-gssapi(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/openssh-ssh1(Ubuntu:26.10) | All versions | No fix listed |
| OpenBSD openssh | < 10.6 | 10.6 |
| OpenBSD openssh | = 10.6 | No fix listed |
| OpenBSD openssh | = 10.6-p1 | No fix listed |
| azure linux openssh(Azure Linux:3.0) | All versions | No fix listed |
References
- MSRC Security Update Guide vendor-advisory
- Release Notes vendor-advisory
- Red Hat CVE page vendor-advisory
- Red Hat Bugzilla 2567690 issue-tracking
- www.cve.org
- nvd.nist.gov
- alpinelinux.org third-party-advisory
- github.com third-party-advisory
- github.com exploit third-party-advisory
- github.com patch
- github.com exploit third-party-advisory
- hachyderm.io third-party-advisory
- marc.info mailing-list vendor-advisory
- news.ycombinator.com issue-tracking
- news.ycombinator.com issue-tracking
- news.ycombinator.com issue-tracking
- sshhole.com exploit technical-description third-party-advisory
- www.openssh.org release-notes
- www.cisa.gov
- Debian Security Tracker CVE-2026-123158 vendor-advisory
- github.com third-party-advisory
- github.com third-party-advisory
- www.openwall.com mailing-list
- sshole.events.greynoise.io third-party-advisory
- isc.sans.edu not-applicable third-party-advisory
- www.cisa.gov government-resource us-government-resource
- Ubuntu CVE tracker vendor-advisory
- security.alpinelinux.org vendor-advisory