Read the docs
TI-2026-85488 Aliases CVE-2026-123158GHSA-4fcc-vm97-gx3x

Password authentication bypass in OpenSSH sshd using musl libc

Priority HIGH 70CWE-394Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

OpenSSH before 10.6p2 on Linux is affected when sshd uses musl libc without PAM, as on Alpine Linux. The sshd daemon lacks a workaround for misinterpreting whether a string is meant to be a password hash (CWE-394). For some account configurations, a remote attacker without credentials can authenticate with any password between 256 and 1024 characters.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00976 62nd percentileScored 2026-11-07
Fix Fixed OpenSSH (OpenBSD): 10.6p2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenBSDOpenSSHbefore 10.6p210.6p2Patch availableCNA
  • OpenSSH VendorOpenBSD Affected before 10.6p2 Fixed in 10.6p2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*——OpenBSD
  • cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:* Versions — — ·OpenBSD

Remediation

Update OpenSSH to 10.6p2, the fixed version. The sources list no vendor advisory identifier for this fix.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA OpenSSH (OpenBSD) Fixed in 10.6p2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 8 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Hardened Images
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-123158
  2. 2026-11-05 CISA SSVC decision points changed
  3. 2026-11-05 Priority changed: MEDIUM → HIGH
  4. 2026-11-05 Alias added: GHSA-4fcc-vm97-gx3x
  5. 2026-11-06 CISA SSVC decision points changed
  6. 2026-11-06 Affected versions changed · Red Hat
  7. 2026-11-06 CVSS score added · Red Hat

References

Other 8

  • TI-2020-05854 smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other… KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-19792 The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently… CVSS 3.1CRITICAL 9.8
  • TI-2002-00376 Integer overflow in xdr_array function in RPC servers for operating systems that use… CVSS 3.1CRITICAL 9.8
  • TI-2024-05929 Openssh: regresshion - race condition in ssh allows rce/dos CVSS 3.1HIGH 8.1
  • TI-2003-00437 Off-by-one error in the fb_realpath() function, as derived from the realpath function in… CVSS 3.1CRITICAL 9.8
  • TI-2007-05153 Stack-based buffer overflow in the cons_options function in options.c in dhcpd in OpenBSD… CVSS 2.0HIGH 7.2
See all 369 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences