CVE-2026-123158 Exploit: sshhole Auth Bypass 1dayexploit / 42min OpenSSH before version 10.6p2, when built against musl libc without PAM, accepts any password between 257 and 1024 bytes for accounts whose shadow password field is exactly (disabled, key-only accounts). sshhole (CVE-2026-123158) is a pre-auth authentication bypass in OpenSSH that affects sshd on musl libc systems.
