sshd in OpenSSH before 10.6p2 on Linux systems using musl libc without PAM lacks proper validation of password hashes, allowing authentication bypass for certain account configurations. Any password between 256 and 1024 characters can succeed in bypassing authentication checks due to misinterpretation of whether a string is a valid password hash.
An unauthenticated attacker over the network can gain unauthorized access to accounts by submitting a password between 256 and 1024 characters, allowing them to log in to systems running vulnerable OpenSSH versions on musl libc-based distributions without requiring valid credentials.
No confirmed exploit available — all analyzed URLs were found to be non-exploitable. There is no evidence of proof of exploitation at the moment.
Patch available - OpenSSH version 10.6p2 or later
Upgrade OpenSSH to version 10.6p2 or later. Prioritize patching systems running Alpine Linux and other musl libc-based distributions that do not use PAM. Alternatively, implement network-level access controls to restrict SSH access and monitor authentication logs for suspicious login attempts with unusually long passwords.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Feedly found the first article mentioning CVE-2026-123158 . See article
NVD published the first details for CVE-2026-123158
A CVSS base score of 8.1 has been assigned.
GitHub Advisories released a security advisory .
This CVE started to trend in security discussions
A pre-authentication authentication bypass vulnerability in OpenSSH affects sshd on musl libc systems, allowing unauthenticated remote attackers to take over accounts with disabled or key-only shadow passwords by inputting passwords between 257 and 1024 bytes. The vulnerability has a CVSS score of 8.1, categorizing it as high risk. There are no details provided regarding exploitation in the wild, proof-of-concept exploits, or available mitigations or patches. See article
[GHSA-4fcc-vm97-gx3x] sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lack
CVE-2026-123158 Exploit: sshhole Auth Bypass
Lightweight Linux distros vulnerable to *sshole password bypass
OpenSSH Releases Emergency Fix for Authentication Bypass Affecting Alpine Linux and Other Musl-Based Systems -
CVE-2026-123158 Exploit: sshhole Auth Bypass
SSH Authentication Bypass on Alpine Linux: 257-Byte Password Authenticates as Root via musl crypt() Bug
Alpine OpenSSH Password Bypass (CVE-2026-123158): Check and Fix
Be the first to know critical vulnerabilities
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
