---
id: "CVE-2026-123158"
kind: "vulnerability"
aliases: ["CVE-2026-123158"]
title: "OpenSSH sshd on musl Linux: password check can be bypassed"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["alpine-linux", "infrastructure", "linux", "musl", "openssh", "sshd"]
not_affected_if: ["glibc-distributions", "no-password-auth", "pam-enabled"]
published_at: "2026-11-05T16:17:47+00:00"
first_seen_at: "2026-11-05T16:40:02+00:00"
updated_at: "2026-11-05T16:41:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123158", "first_seen_at": "2026-11-05T16:40:02+00:00"}]
exploit_sources: []
---

# OpenSSH sshd on musl Linux: password check can be bypassed

On Linux builds of OpenSSH sshd that use musl libc without PAM, some account configurations accept any password between 256 and 1024 characters. An attacker who knows a username can log in without the real password.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `sshd -V` or `ssh -V` and compare the version against `10.6p2`
- Check whether the host runs Alpine Linux or another musl-based distribution
- Check whether PAM is used for sshd authentication (`/etc/pam.d/sshd` and `UsePAM` in `sshd_config`)

## Fix

- OpenSSH: move to `10.6p2` or later

## Timeline

- 2026-11-05T16:40:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123158

## Documents

- [fix] Patch: github.com https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482

## From the sources

sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_