OpenBSD OpenSSH flaw allows password authentication bypass

What happened

A vulnerability tracked as CVE-2026-123158 affects sshd, the server component of OpenSSH, on Linux systems built with the musl C library and running without PAM. In that setup, sshd is missing a safeguard against a password authentication bypass. The underlying issue concerns how the system decides whether a given string should be treated as a password hash. For certain account configurations, sufficiently long passwords may be accepted even when they are wrong. An attacker able to reach the SSH service could therefore gain access to an account without knowing its password.

Alpine Linux is named as an example of a platform that combines musl libc with no PAM. The weakness is classified as CWE-394. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-11-09, which means it is being actively exploited.

Who is affected

The affected product is OpenSSH from OpenBSD. The listed vulnerable versions include all releases before 10.6 as well as certain 10.6 releases; the vendor advisory lists the affected and fixed versions. The issue only applies to sshd on Linux when musl libc is used without PAM, with Alpine Linux given as an example of such a platform. Systems that do not match this configuration are not described as affected in the data available to us.

How serious is it

The flaw has a CVSS 3.1 base score of 8.1, rated high. The score reflects network reachability with no privileges or user interaction required, though attack complexity is rated high. Microsoft also rates the issue as high in its advisory and reports that a fix exists.

The practical risk is raised by confirmed exploitation: CISA lists the flaw in its Known Exploited Vulnerabilities catalog and has set a remediation due date of 2026-11-12 for federal agencies. The EPSS score, an estimate of the likelihood of exploitation, is 0.16501. A successful bypass could give an attacker full access to the affected account, with high impact on confidentiality, integrity and availability.

What you should do

1. 1Identify Linux systems running OpenSSH sshd with musl libc and without PAM, such as Alpine Linux hosts and containers.
2. 2Update OpenSSH to version 10.6p2 on affected systems.
3. 3Review the Microsoft advisory CVE-2026-123158 and the OpenSSH release notes for vendor guidance.
4. 4Apply vendor mitigations in line with the CISA required action, and stop using the product where no mitigations are available.
5. 5Treat the CISA due date of 2026-11-12 as a deadline for remediating exposed systems.
6. 6Review SSH authentication logs on affected hosts for unexpected successful logins.

Quick facts