Vulnerability-Lookup

CVE-2026-123158 (GCVE-0-2026-123158)

Vulnerability from cvelistv5 – Published: 2026-11-05 15:46 – Updated: 2026-11-06 04:56

Summary

sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-05 00:00 UTC

CWE

CWE-394 - Unexpected Status Code or Return Value

Assigner

mitre CNA under the mitre root

CNA scorecard E 29/100 over 2230 records in the last 180 days details

References

12 references

URL	Tags
https://www.openssh.org/releasenotes.html#10.6p2
https://github.com/openssh/openssh-portable/commi…
https://news.ycombinator.com/item?id=50377976
https://news.ycombinator.com/item?id=50378228
https://marc.info/?l=openssh-unix-dev&m=179388064…
https://hachyderm.io/@damienmiller/117563026759098135
https://github.com/predkambrij/sshhole-repro
https://github.com/leonjza/sshhole-lab
https://alpinelinux.org/posts/2026-11-05-openssh-…
https://news.ycombinator.com/item?id=50379704
https://github.com/google/goonami-scanner/pull/277
https://sshhole.com	exploit

Impacted products

1 product

Vendor	Product	Version	CPE status
OpenBSD	OpenSSH	Affected: 0 , < 10.6p2 (custom) cpe:2.3:a:openbsd:openssh::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-11-05T21:06:39.062Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/"
          },
          {
            "url": "https://news.ycombinator.com/item?id=50379704"
          },
          {
            "url": "https://github.com/google/goonami-scanner/pull/277"
          }
        ],
        "title": "CVE Program Container",
        "x_generator": {
          "engine": "ADPogram 0.0.1"
        }
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-123158",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-05T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T04:56:35.243Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://sshhole.com"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux"
          ],
          "product": "OpenSSH",
          "vendor": "OpenBSD",
          "versions": [
            {
              "lessThan": "10.6p2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "10.6p2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-394",
              "description": "CWE-394 Unexpected Status Code or Return Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-05T15:46:26.488Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.openssh.org/releasenotes.html#10.6p2"
        },
        {
          "url": "https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482"
        },
        {
          "url": "https://news.ycombinator.com/item?id=50377976"
        },
        {
          "url": "https://news.ycombinator.com/item?id=50378228"
        },
        {
          "url": "https://marc.info/?l=openssh-unix-dev\u0026m=179388064263131\u0026w=2"
        },
        {
          "url": "https://hachyderm.io/@damienmiller/117563026759098135"
        },
        {
          "url": "https://github.com/predkambrij/sshhole-repro"
        },
        {
          "url": "https://github.com/leonjza/sshhole-lab"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-123158",
    "datePublished": "2026-11-05T15:46:26.488Z",
    "dateReserved": "2026-11-05T15:46:25.881Z",
    "dateUpdated": "2026-11-06T04:56:35.243Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-123158",
      "date": "2026-11-06",
      "epss": "0.00976",
      "percentile": "0.6228"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "platforms": [
                  "Linux"
                ],
                "product": "OpenSSH",
                "vendor": "OpenBSD",
                "versions": [
                  {
                    "lessThan": "10.6p2",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "cve@mitre.org"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux."
          }
        ],
        "id": "CVE-2026-123158",
        "lastModified": "2026-11-06T05:18:26.710",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 5.9,
              "source": "cve@mitre.org",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-123158",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-05T00:00:00+00:00",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-11-05T16:17:47.110",
        "references": [
          {
            "source": "cve@mitre.org",
            "url": "https://github.com/leonjza/sshhole-lab"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://github.com/predkambrij/sshhole-repro"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://hachyderm.io/@damienmiller/117563026759098135"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://marc.info/?l=openssh-unix-dev\u0026m=179388064263131\u0026w=2"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://news.ycombinator.com/item?id=50377976"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://news.ycombinator.com/item?id=50378228"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://www.openssh.org/releasenotes.html#10.6p2"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://github.com/google/goonami-scanner/pull/277"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://news.ycombinator.com/item?id=50379704"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://sshhole.com"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vulnStatus": "Received",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-394"
              }
            ],
            "source": "cve@mitre.org",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-11-06T19:20:03+00:00",
      "cve": "CVE-2026-123158",
      "id": "CVE-2026-123158",
      "initial_release_date": "2026-11-05T15:46:26.488000+00:00",
      "product_status:known_not_affected": "39",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "openssh: OpenSSH: Password authentication bypass via password hash misinterpretation",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-123158.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2026-11-05T21:06:39.062Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "url": "https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/"
              },
              {
                "url": "https://news.ycombinator.com/item?id=50379704"
              },
              {
                "url": "https://github.com/google/goonami-scanner/pull/277"
              }
            ],
            "title": "CVE Program Container",
            "x_generator": {
              "engine": "ADPogram 0.0.1"
            }
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-123158",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-11-05T17:12:53.200399Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-11-05T17:13:25.952Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://sshhole.com"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "platforms": [
                "Linux"
              ],
              "product": "OpenSSH",
              "vendor": "OpenBSD",
              "versions": [
                {
                  "lessThan": "10.6p2",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "10.6p2",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-394",
                  "description": "CWE-394 Unexpected Status Code or Return Value",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-11-05T15:46:26.488Z",
            "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            "shortName": "mitre"
          },
          "references": [
            {
              "url": "https://www.openssh.org/releasenotes.html#10.6p2"
            },
            {
              "url": "https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482"
            },
            {
              "url": "https://news.ycombinator.com/item?id=50377976"
            },
            {
              "url": "https://news.ycombinator.com/item?id=50378228"
            },
            {
              "url": "https://marc.info/?l=openssh-unix-dev\u0026m=179388064263131\u0026w=2"
            },
            {
              "url": "https://hachyderm.io/@damienmiller/117563026759098135"
            },
            {
              "url": "https://github.com/predkambrij/sshhole-repro"
            },
            {
              "url": "https://github.com/leonjza/sshhole-lab"
            }
          ],
          "x_generator": {
            "engine": "CVE-Request-form 0.0.1"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "assignerShortName": "mitre",
        "cveId": "CVE-2026-123158",
        "datePublished": "2026-11-05T15:46:26.488Z",
        "dateReserved": "2026-11-05T15:46:25.881Z",
        "dateUpdated": "2026-11-06T04:56:35.243Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2026-AVI-1468

Vulnerability from certfr_avis - Published: 2026-11-05 - Updated: 2026-11-06

Une vulnérabilité a été découverte dans OpenSSH. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	OpenSSH	OpenSSH	OpenSSH versions antérieures à 10.6p2

References

Title

Publication Time

FKIE_CVE-2026-123158

Vulnerability from fkie_nvd - Published: 2026-11-05 16:17 - Updated: 2026-11-06 05:18

Severity

8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	cve@mitre.org	https://github.com/leonjza/sshhole-lab
	cve@mitre.org	https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482
	cve@mitre.org	https://github.com/predkambrij/sshhole-repro
	cve@mitre.org	https://hachyderm.io/@damienmiller/117563026759098135
	cve@mitre.org	https://marc.info/?l=openssh-unix-dev&m=179388064263131&w=2
	cve@mitre.org	https://news.ycombinator.com/item?id=50377976
	cve@mitre.org	https://news.ycombinator.com/item?id=50378228
	cve@mitre.org	https://www.openssh.org/releasenotes.html#10.6p2
	af854a3a-2127-422b-91ae-364da2661108	https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/
	af854a3a-2127-422b-91ae-364da2661108	https://github.com/google/goonami-scanner/pull/277
	af854a3a-2127-422b-91ae-364da2661108	https://news.ycombinator.com/item?id=50379704
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://sshhole.com

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux"
          ],
          "product": "OpenSSH",
          "vendor": "OpenBSD",
          "versions": [
            {
              "lessThan": "10.6p2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux."
    }
  ],
  "id": "CVE-2026-123158",
  "lastModified": "2026-11-06T05:18:26.710",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.9,
        "source": "cve@mitre.org",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-123158",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-11-05T00:00:00+00:00",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-11-05T16:17:47.110",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "https://github.com/leonjza/sshhole-lab"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://github.com/predkambrij/sshhole-repro"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://hachyderm.io/@damienmiller/117563026759098135"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://marc.info/?l=openssh-unix-dev\u0026m=179388064263131\u0026w=2"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://news.ycombinator.com/item?id=50377976"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://news.ycombinator.com/item?id=50378228"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.openssh.org/releasenotes.html#10.6p2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/google/goonami-scanner/pull/277"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://news.ycombinator.com/item?id=50379704"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://sshhole.com"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-394"
        }
      ],
      "source": "cve@mitre.org",
      "type": "Secondary"
    }
  ]
}

GHSA-4FCC-VM97-GX3X

Vulnerability from github – Published: 2026-11-05 18:33 – Updated: 2026-11-05 21:34

Details

Severity

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-123158"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-394"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-11-05T16:17:47Z",
    "severity": "HIGH"
  },
  "details": "sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.",
  "id": "GHSA-4fcc-vm97-gx3x",
  "modified": "2026-11-05T21:34:49Z",
  "published": "2026-11-05T18:33:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123158"
    },
    {
      "type": "WEB",
      "url": "https://github.com/google/goonami-scanner/pull/277"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482"
    },
    {
      "type": "WEB",
      "url": "https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass"
    },
    {
      "type": "WEB",
      "url": "https://github.com/leonjza/sshhole-lab"
    },
    {
      "type": "WEB",
      "url": "https://github.com/predkambrij/sshhole-repro"
    },
    {
      "type": "WEB",
      "url": "https://hachyderm.io/@damienmiller/117563026759098135"
    },
    {
      "type": "WEB",
      "url": "https://marc.info/?l=openssh-unix-dev\u0026m=179388064263131\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "https://news.ycombinator.com/item?id=50377976"
    },
    {
      "type": "WEB",
      "url": "https://news.ycombinator.com/item?id=50378228"
    },
    {
      "type": "WEB",
      "url": "https://news.ycombinator.com/item?id=50379704"
    },
    {
      "type": "WEB",
      "url": "https://sshhole.com"
    },
    {
      "type": "WEB",
      "url": "https://www.openssh.org/releasenotes.html#10.6p2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

NCSC-2026-0469

Vulnerability from csaf_ncscnl - Published: 2026-11-06 07:54 - Updated: 2026-11-06 07:54

Summary

Kwetsbaarheid verholpen in OpenSSH door OpenSSH Project

Scope

1 vulnerability in this advisory, including CVE-2026-123158.

CVE-2026-123158

OpenSSH sshd versions prior to 10.6p2 on Linux systems using musl libc without PAM are vulnerable to a password authentication bypass for passwords between 256 and 1024 characters, notably impacting Alpine Linux.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Known affected: 1 product

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-123158 (GCVE-0-2026-123158)

CERTFR-2026-AVI-1468

Solutions

FKIE_CVE-2026-123158

GHSA-4FCC-VM97-GX3X

NCSC-2026-0469

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour