CVE-2026-123158: Password Bypass in OpenSSH on Linux

CVE-2026-123158 identifies a critical flaw in sshd, the SSH daemon of OpenSSH in versions before 10.6p2 on Linux systems with musl libc and without PAM. The vulnerability lies in a misinterpretation of whether a string should be treated as a password hash. For certain accounts, any password between 256 and 1024 characters bypasses authentication, allowing unauthorized access. Alpine Linux, which uses musl libc without PAM, is specifically vulnerable.

The CVSS score is 8.1, classified as high severity by NVD. The vulnerability was published on 2026-11-05 and is reported as novel in the security landscape. On GitHub, public repositories claiming to contain related exploits have been detected. Signals on X show 11 posts in the last 24 hours with high engagement, confirming awareness and community attention. Status is verified through official NVD source and consistent signals from multiple channels.

For defenders, immediate actions: 1) verify OpenSSH version using 'ssh -V' on all critical systems, prioritizing Alpine Linux and musl distributions; 2) apply update to 10.6p2 or later as soon as available; 3) as temporary mitigation, disable password authentication and use SSH keys; 4) review recent SSH authentication logs for anomalous access or suspicious patterns; 5) verify accounts and permissions for any unauthorized changes.

The specifically vulnerable configuration is OpenSSH on Linux with musl libc without PAM. Systems with standard glibc or with PAM enabled are not directly exposed to this flaw. However, administrators of heterogeneous environments must verify every host, as the distinction may not be immediately obvious. Alpine Linux remains the most critical use case in this vulnerability.