CISA has added CVE-2026-123158 to its Known Exploited Vulnerabilities (KEV) catalog: an OpenSSH flaw on Linux systems that use musl libc without PAM, such as Alpine Linux, that can let attackers bypass password authentication.
What Is It
CVE-2026-123158 affects sshd in OpenSSH before 10.6p2 on Linux when musl libc is used without PAM. sshd is missing a workaround for a password authentication bypass. The bypass comes from misreading whether a string is meant to be a password hash. For some account configurations, any password between 256 and 1024 characters is accepted. NVD lists Alpine Linux as an example of a platform that uses musl libc without PAM.
CISA classifies the weakness as CWE-394 (Unexpected Status Code or Return Value). The KEV entry describes the impact as authentication bypass.
Why It Matters
CISA added the CVE to KEV on 2026-11-09, which confirms active exploitation. CISA's SSVC assessment rates exploitation as "active," technical impact as "total," and automatable as "no." The CVSS 3.1 base score is 8.1 (High), with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H: network-reachable, no privileges or user interaction required, and high impact to confidentiality, integrity, and availability.
NVD references include public repositories tagged "Exploit" (sshhole-lab and sshhole-repro). CISA lists known ransomware campaign use as "Unknown." The KEV entry is flagged for forensic triage, so CISA expects affected organizations to investigate as well as patch.
What's Vulnerable
- OpenSSH (OpenBSD) on Linux, all versions before 10.6p2, including 10.6 and 10.6p1
- Only when sshd runs with musl libc and without PAM
- NVD's configuration pairs the affected OpenSSH versions with Alpine Linux releases before 3.21.10, 3.22.0 to before 3.22.8, 3.23.0 to before 3.23.8, and 3.24.0 to before 3.24.4
KEV notes that the flaw sits in an open-source component that other products may use. Downstream images and appliances built on musl without PAM, such as container base images, may also be exposed.
Patch Status
The fix is in OpenSSH 10.6p2 (upstream commit 4353fdc4). Alpine Linux has published its own advisory.
CISA's required action is to apply mitigations according to vendor instructions, in line with BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's Forensics Triage Requirements. If mitigations aren't available, follow BOD 26-04 guidance for cloud services or stop using the product. Stakeholders must assess each asset's internet exposure. The federal remediation due date is 2026-11-12.
Sources
- CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- NVD CVE-2026-123158: https://nvd.nist.gov/vuln/detail/CVE-2026-123158
- OpenSSH 10.6p2 Release Notes: https://www.openssh.org/releasenotes.html#10.6p2
- OpenSSH Patch Commit: https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482
- Alpine Linux Advisory: https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/
- openssh-unix-dev Mailing List: https://marc.info/?l=openssh-unix-dev&m=179388064263131&w=2
- oss-security: http://www.openwall.com/lists/oss-security/2026/11/09/27
- CISA BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- CISA Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk