Back Hkcert

OpenSSH Security Restriction Bypass Vulnerability

Hkcert • November 6, 2026

A vulnerability was identified in OpenSSH. A remote attacker could exploit some of these vulnerabilities to trigger security restriction bypass on the targeted system.

Proof-of-concept code is publicly available for CVE-2026-123158. sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). An example of a platform using musl libc without PAM is Alpine Linux. Other mainstream Linux distributions (such as Red Hat, SUSE, Ubuntu and Debian, etc.) utilize the glibc library and are unaffected by this vulnerability.

Security Restriction Bypass

System / Technologies affected

OpenSSH versions before 10.6p2

Before installation of the software, please visit the vendor web-site for more details.

Apply fixes issued by the vendor:

Vulnerability Identifier

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical OpenSSH Vulnerability Allows Password Bypass on Alpine Linux A critical vulnerability, tracked as CVE-2026-123158, has been discovered in OpenSSH affecting Alpine Linux and other musl-based systems. The flaw allows attackers to bypass password authentication for accounts configured with no password by entering a long password (between 257 and 1,024 characters). This vulnerability stems from the interaction between OpenSSH and musl libc, specifically when PAM is disabled. OpenSSH version 10.6p2 was released on November 5, 2026, to address this issue. Systems using glibc or those configured with PAM are not affected. The vulnerability has existed for nearly a decade and poses a significant risk, particularly to cloud environments using Alpine Linux. Administrators are advised to immediately update their systems or disable password authentication. No active exploitation has been reported yet. 16 sources 72

Extracted Entities

OpenSSH Security Restriction Bypass Vulnerability

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Malware (1)

Platforms (4)