8.1
High
CVE-2026-123158 sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password…
Description
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- Interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| OpenSSH 10.6 | earliest → < 10.6p2 | 10.6p2 |
References
- www.openssh.org www.openssh.org
- github.com github.com
- news.ycombinator.com news.ycombinator.com
- news.ycombinator.com news.ycombinator.com
- marc.info marc.info
- hachyderm.io hachyderm.io
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of OpenSSH
The 33 CVEs of OpenSSH →
CVE-2026-106583
In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection
2.5
Low
CVE-2026-106589
In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can…
2.9
Low
CVE-2026-106588
In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which…
3.1
Low
CVE-2026-106587
In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but…
3.6
Low