CVE-2026-123158
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
Am I affected?
Sign in and add the software you use to your watchlist: we check it against every new vulnerability.
Show me how to fix itTimeline
- Published by NVD
- Last updated by NVD
- First covered by RedTeamDaily
Coverage
Critical OpenSSH flaw lets attackers log into password-disabled accounts on musl-based Linux
OpenSSH servers on Linux systems using the musl C library are vulnerable to a critical authentication bypass, tracked as CVE-2026-123158. A password of 257 to 1,024 characters makes the login check return a value that matches accounts with disabled passwords, so the login succeeds. OpenSSH 10.6p2 and emergency Alpine openssh updates mitigate the issue, and the affected configurations are most likely to be found on Alpine.
Sources: NVD and CISA known exploited vulnerabilities catalogue.