CVE-2026-123158 · Infrastructure
NO FIX YET · SEE WHAT TO DO
On Linux builds of OpenSSH sshd that use musl libc without PAM, some account configurations accept any password between 256 and 1024 characters. An attacker who knows a username can log in without the real password.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only sshd builds on Linux that link against musl libc and do not use PAM, such as some Alpine Linux hosts, are described as exposed. Standard glibc-based distributions with PAM are not named in the sources. Teams running SSH on Alpine or other musl systems without PAM should look at this first.
Not affected if glibc-distributions, no-password-auth, pam-enabled
Who cares alpine-linux, linux, musl, openssh, sshd
sshd -V or ssh -V and compare the version against 10.6p2/etc/pam.d/sshd and UsePAM in sshd_config)10.6p2 or latersshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.