{"id":"CVE-2026-123158","kind":"vulnerability","aliases":["CVE-2026-123158"],"related":[],"title":"OpenSSH sshd on musl Linux: password check can be bypassed","description":"sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.","summary":"On Linux builds of OpenSSH sshd that use musl libc without PAM, some account configurations accept any password between 256 and 1024 characters. An attacker who knows a username can log in without the real password.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["alpine-linux","infrastructure","linux","musl","openssh","sshd"],"not_affected_if":["glibc-distributions","no-password-auth","pam-enabled"],"how_to_check":"- Run `sshd -V` or `ssh -V` and compare the version against `10.6p2`\n- Check whether the host runs Alpine Linux or another musl-based distribution\n- Check whether PAM is used for sshd authentication (`/etc/pam.d/sshd` and `UsePAM` in `sshd_config`)","fix":"- OpenSSH: move to `10.6p2` or later","status":"open","published_at":"2026-11-05T16:17:47+00:00","first_seen_at":"2026-11-05T16:40:02+00:00","triaged_at":"2026-11-05T16:41:28+00:00","updated_at":"2026-11-05T16:41:28+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-05T16:41:28Z","model":"claude-haiku-5-5","output":{"fix":"- OpenSSH: move to `10.6p2` or later","reach":"internet","title":"OpenSSH sshd on musl Linux: password check can be bypassed","impact":"high","summary":"On Linux builds of OpenSSH sshd that use musl libc without PAM, some account configurations accept any password between 256 and 1024 characters. An attacker who knows a username can log in without the real password.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["openssh","sshd","alpine-linux","musl","linux"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Remote login to affected accounts without the correct password","analyst_note":"Sources do not list affected account configurations or confirm the fix commit; check the OpenSSH 10.6p2 release notes and the NVD entry for the exact conditions.","how_to_check":"- Run `sshd -V` or `ssh -V` and compare the version against `10.6p2`\n- Check whether the host runs Alpine Linux or another musl-based distribution\n- Check whether PAM is used for sshd authentication (`/etc/pam.d/sshd` and `UsePAM` in `sshd_config`)","plain_action":"","needs_analyst":true,"not_affected_if":["pam-enabled","glibc-distributions","no-password-auth"],"who_is_affected":"Only sshd builds on Linux that link against musl libc and do not use PAM, such as some Alpine Linux hosts, are described as exposed. Standard glibc-based distributions with PAM are not named in the sources. Teams running SSH on Alpine or other musl systems without PAM should look at this first.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000732,"input_tokens":4270,"output_tokens":610,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123158':13A,16A '-2026':12A,15A '10.6':65C '1024':46B,108C '256':44B,106C 'accept':40B 'account':38B,102C 'alpin':18B,122C 'alpine-linux':17B 'attack':49B 'authent':82C 'build':27B 'bypass':10A,83C 'charact':47B,109C 'check':7A 'configur':39B,100C 'cve':11A,14A 'exampl':112C 'hash':97C 'infrastructur':20B 'intend':92C 'know':51B 'lack':76C 'libc':34B,71C,118C 'linux':5A,19B,21B,26B,68C,123C 'log':55B 'misinterpret':86C 'musl':4A,22B,33B,70C,117C 'openssh':1A,23B,29B,63C 'p2':66C 'pam':36B,75C,120C 'password':6A,42B,60B,81C,96C,104C 'platform':115C 'real':59B 'relat':84C 'sshd':2A,24B,30B,61C 'string':90C 'succeed':110C 'use':32B,73C,116C 'usernam':53B 'whether':88C 'without':35B,57B,74C,119C 'workaround':78C","nicknames":[],"mitigations":[],"who_affected":"Only sshd builds on Linux that link against musl libc and do not use PAM, such as some Alpine Linux hosts, are described as exposed. Standard glibc-based distributions with PAM are not named in the sources. Teams running SSH on Alpine or other musl systems without PAM should look at this first.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["alpinelinux","high","infrastructure","linux","musl","openssh","sshd"],"campaign_type":null,"first_public_at":"2026-11-05T16:17:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123158","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123158","severity":null,"published_at":"2026-11-05T16:17:47+00:00","modified_at":"2026-11-05T16:17:47+00:00","first_seen_at":"2026-11-05T16:40:02+00:00","fetched_at":"2026-11-05T16:40:02+00:00","note":null}],"documents":[{"id":77649,"url":"https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}