CVE-2026-123158

sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.

CVSS

8.1

EPSS

—

CISA KEV

Not listed

Exploitation

poc

Public exploits

None seen

State

PUBLISHED

Coverage

• Help Net Security◇Specialist. Specialist publisher: established trade press, or expert analysis with a track record2 hours ago

  OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158)

  An OpenSSH flaw that lets remote attackers log into passwordless accounts on Alpine Linux and other musl-based systems is being exploited, threat intelligence firm Previdian has warned. The flaw (CVE-2026-123158), nicknamed sshole by Wakefield researcher Özgün Kültekin, was fixed in OpenSSH 10.6p2…

  ↗helpnetsecurity.com/2026/11/06/openssh-sshole-c…(opens the publisher's site in a new tab)

What we observed