Skip to content
Critical OpenSSH Vulnerability Allows Password Bypass on Alpine Linux

Critical OpenSSH Vulnerability Allows Password Bypass on Alpine Linux

First seen 5 Nov 2026, 17:18 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 6, 2026 at 01:16 UTC
  • •CVE-2026-123158 allows password bypass on Alpine Linux and musl-based systems.
  • •Attackers can log in using passwords between 257 and 1,024 characters for accounts with no password.
  • •OpenSSH 10.6p2 released on November 5, 2026, addresses the vulnerability.

A critical vulnerability, tracked as CVE-2026-123158, has been discovered in OpenSSH affecting Alpine Linux and other musl-based systems. The flaw allows attackers to bypass password authentication for accounts configured with no password by entering a long password (between 257 and 1,024 characters). This vulnerability stems from the interaction between OpenSSH and musl libc, specifically when PAM is disabled. OpenSSH version 10.6p2 was released on November 5, 2026, to address this issue. Systems using glibc or those configured with PAM are not affected. The vulnerability has existed for nearly a decade and poses a significant risk, particularly to cloud environments using Alpine Linux. Administrators are advised to immediately update their systems or disable password authentication. No active exploitation has been reported yet.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 5h ago How this analysis works

Timeline

2026-11-05
CVE-2026-123158 published
OpenSSH released version 10.6p2 to fix a critical password authentication bypass vulnerability.
Pasqualepillitteri.It
2026-11-05
Alpine Linux advisory released
Alpine published an advisory detailing the vulnerability and the conditions under which systems are affected.
Ox.Security
2026-11-06
Security experts warn of vulnerability
Experts emphasize the risk of the vulnerability in cloud environments and recommend immediate updates or configuration changes.
Csoonline

More articles in this cluster (32)

Following this threat?

Track Pam and CVE-2016-6210 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (18)

1 / 4

Common questions

Which systems are affected?
Alpine Linux and other musl-based systems running OpenSSH without PAM are affected.
What should I do if I'm affected?
Immediately update to OpenSSH version 10.6p2 or disable password authentication in your SSH configuration.
Is there evidence of exploitation in the wild?
No confirmed exploitation has been reported as of now.