Critical OpenSSH flaw lets attackers log into password-disabled accounts on musl-based Linux
CRITICAL · VULNERABILITYOpenSSHredteam/daily · 1 source
- Severity
- Critical
- Highest CVSS
- 8.1
- Exploited
- Not known
- Sources
- 1
What happened
OpenSSH servers on Linux systems using the musl C library are vulnerable to a critical authentication bypass, tracked as CVE-2026-123158. A password of 257 to 1,024 characters makes the login check return a value that matches accounts with disabled passwords, so the login succeeds. OpenSSH 10.6p2 and emergency Alpine openssh updates mitigate the issue, and the affected configurations are most likely to be found on Alpine.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Update OpenSSH to version 10.6p2 or install the fixed Alpine openssh package.
- If you cannot update, disable password-based authentication in the OpenSSH configuration and set up key-based authentication.
- Check logs for 'Accepted password' entries on accounts that have no password, such as root, key-only users or the default alpine user.
- Review doas usage and recently created users, and treat any server where a login cannot be ruled out as compromised.
Written by AI from the sources, checked against them
Vulnerabilities
Full story timeline · 2 updates
Who reported · 1 outlet
CSO Online