CVE-2026-123158

sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.

• CWE-394

• https://github.com/leonjza/sshhole-lab
• https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482
• https://github.com/predkambrij/sshhole-repro
• https://hachyderm.io/@damienmiller/117563026759098135
• https://marc.info/?l=openssh-unix-dev&m=179388064263131&w=2
• https://news.ycombinator.com/item?id=50377976
• https://news.ycombinator.com/item?id=50378228
• https://www.openssh.org/releasenotes.html#10.6p2
• https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/
• https://github.com/google/goonami-scanner/pull/277
• https://news.ycombinator.com/item?id=50379704
• https://sshhole.com

Published

Nov 5, 2026

Last Modified

Nov 5, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-123125The Symfony Validator component IpValidator incompletely cla…6.5
• CVE-2026-12313Information disclosure, sandbox escape in the Security: Proc…4.7
• CVE-2026-123135A vulnerability was found in langgenius dify up to 1.18.0/2.…6.3
• CVE-2026-12314Memory safety bug fixed in Thunderbird 152. This vulnerabili…7.5
• CVE-2026-12315Mitigation bypass in the DOM: Security component. This vulne…9.1
• CVE-2026-123151A flaw was found in the GNU debugger (GDB). When GDB connect…
• CVE-2026-12316Mitigation bypass in the DOM: Security component. This vulne…9.1
• CVE-2026-12317Memory safety bug fixed in Thunderbird 152. This vulnerabili…7.5
• CVE-2026-12318Incorrect boundary conditions in the Libraries component in …7.3
• CVE-2026-123184An incorrect authorization vulnerability exists in the Altiu…8.1
• CVE-2026-12319Denial-of-service in the Audio/Video: Playback component. Th…6.5
• CVE-2026-123196Authorizer before 2.4.2 contains a password reset poisoning …8.1