{"affected":[{"defaultStatus":"unaffected","platforms":["Linux"],"product":"OpenSSH","source":"CNA: mitre","vendor":"OpenBSD","versions":[{"lessThan":"10.6p2","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-123158","cwes":["CWE-394"],"description":"sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.","epss":null,"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://sshhole.com/"}],"kev":null,"metrics":[{"score":8.1,"severity":"high","source":"CNA: mitre","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},{"score":8.1,"severity":"high","source":"NVD: cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793942306710,"publishedAt":1793893586488,"references":[{"source":"CNA: mitre","tags":[],"url":"https://www.openssh.org/releasenotes.html#10.6p2"},{"source":"CNA: mitre","tags":[],"url":"https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482"},{"source":"CNA: mitre","tags":[],"url":"https://news.ycombinator.com/item?id=50377976"},{"source":"CNA: mitre","tags":[],"url":"https://news.ycombinator.com/item?id=50378228"},{"source":"CNA: mitre","tags":[],"url":"https://marc.info/?l=openssh-unix-dev&m=179388064263131&w=2"},{"source":"CNA: mitre","tags":[],"url":"https://hachyderm.io/@damienmiller/117563026759098135"},{"source":"CNA: mitre","tags":[],"url":"https://github.com/predkambrij/sshhole-repro"},{"source":"CNA: mitre","tags":[],"url":"https://github.com/leonjza/sshhole-lab"},{"source":"ADP: CVE","tags":[],"url":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/"},{"source":"ADP: CVE","tags":[],"url":"https://news.ycombinator.com/item?id=50379704"},{"source":"ADP: CVE","tags":[],"url":"https://github.com/google/goonami-scanner/pull/277"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://sshhole.com/"},{"source":"cve@mitre.org","tags":[],"url":"https://github.com/leonjza/sshhole-lab"},{"source":"cve@mitre.org","tags":[],"url":"https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482"},{"source":"cve@mitre.org","tags":[],"url":"https://github.com/predkambrij/sshhole-repro"},{"source":"cve@mitre.org","tags":[],"url":"https://hachyderm.io/@damienmiller/117563026759098135"},{"source":"cve@mitre.org","tags":[],"url":"https://marc.info/?l=openssh-unix-dev&m=179388064263131&w=2"},{"source":"cve@mitre.org","tags":[],"url":"https://news.ycombinator.com/item?id=50377976"},{"source":"cve@mitre.org","tags":[],"url":"https://news.ycombinator.com/item?id=50378228"},{"source":"cve@mitre.org","tags":[],"url":"https://www.openssh.org/releasenotes.html#10.6p2"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"url":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"url":"https://github.com/google/goonami-scanner/pull/277"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"url":"https://news.ycombinator.com/item?id=50379704"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":[],"url":"https://sshhole.com/"}],"remediation":[],"revision":"ab2c1f0520208a3185024e3a23de5d1186d82b1b8e531f9d07033795b84b4331","sources":[{"modifiedAt":1793940995243,"name":"CNA: mitre","retrievedAt":1793941719099,"url":"https://www.cve.org/CVERecord?id=CVE-2026-123158"},{"modifiedAt":1793942306710,"name":"NVD","retrievedAt":1793946349799,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123158"}],"ssvc":{"assessedAt":1793836800000,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"CVE-2026-123158","updatedAt":1793946349799}