CVE-2026-123158

HIGH

sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.

CVSS v3.1 Score

8.1
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Complexity
HIGH
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Published: 11/5/2026Modified: 11/8/2026

Related Intelligence (3)

MEDIUMVulnerability

Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th)

Our honeypots use "Cowrie" to collect SSH data. With the emergence of the "sshole" vulnerability last week, we are now seeing an increase in attempts to exploit the vulnerability. Our data is a bit limited in this respect. Our honeypots collect only the first 255 characters of SSH passwords. Longer passwords are highly unusual and not used for the usual password brute-forcing we observe.

CVE-2026-123158
SANS ISC
MEDIUMVulnerability

Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot

Threat actors are attempting to exploit a recently disclosed security flaw impacting OpenSSH that can enable sign-ins to accounts that have no password set, according to Previdian. The vulnerability, tracked as CVE-2026-123158 (CVSS score: 8.1) and codenamed SSHole (or *sshole), impacts Linux systems that run OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled,

CVE-2026-123158
The Hacker News
CRITICALVulnerability

OpenSSH flaw lets attackers access password-disabled accounts on some Linux systems

A critical vulnerability that affects OpenSSH servers on Linux systems built with the musl C library instead of glibc allows remote attackers to easily bypass authentication and log into accounts that should have password authentication disabled. The flaw impacts the lightweight Alpine Linux, which is widely used for cloud Docker container images, as well as Linux distributions for embedded system

CVE-2026-123158
CSO Online

References (14)

https://github.com/leonjza/sshhole-labhttps://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482https://github.com/predkambrij/sshhole-reprohttps://hachyderm.io/@damienmiller/117563026759098135https://marc.info/?l=openssh-unix-dev&m=179388064263131&w=2https://news.ycombinator.com/item?id=50377976https://news.ycombinator.com/item?id=50378228https://www.openssh.org/releasenotes.html#10.6p2https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/https://github.com/coollabsio/coolify/discussions/12484https://github.com/google/goonami-scanner/pull/277https://github.com/panubo/docker-sshd/issues/93https://news.ycombinator.com/item?id=50379704https://sshhole.com