CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

OpenSSH Portable before 10.6p2 on musl libc without PAM (*sshole): a password of 257 to 1,024 bytes logs in to accounts whose password field is *

cve · CVE-2026-123158

Coverage
1
first 2026-11-06 → last 2026-11-06
Latest activity
2026-11-06
OpenSSH 10.6p2: password bypass on musl Linux without PAM (Alpine, OpenWrt); update or turn passwords off
Peak priority
notable
1 notable
Targets
·
no sector or region stated
Sources cited
4
4 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-123158, newest first. Check the date before acting on an older one.

  • On every musl-based Linux host that runs sshd (Alpine, OpenWrt, Buildroot, Yocto), install OpenSSH 10.6p2 or the distribution's fixed openssh package and restart sshd, because updating the package does not replace the running server, and rebuild container and cloud images from a fixed base; until then set PasswordAuthentication no in sshd_config and restart sshd.
    2026-11-06CVE-2026-123158

Defender insights

What each entry about CVE-2026-123158 tells a defender to do, newest first.

2026-11-06NOTABLEOpenSSH 10.6p2: password bypass on musl Linux without PAM (Alpine, OpenWrt); update or turn passwords off

Exposure · triage · detection

Story timeline

  1. 2026-11-06CVE-2026-123158, OpenSSH Portable before 10.6p2 (*sshole): on Linux with musl libc and no PAM, a password of 257 to 1,024 bytes logs in to accounts whose password field is *; NCSC Switzerland issued an advisory (CVSS 3.1 8.1)
    trending-vulnerabilitiesOpenSSH 10.6p2: password bypass on musl Linux without PAM (Alpine, OpenWrt); update or turn passwords off

Hunting pivots

Affected products
Alpine LinuxOpenSSHOpenWrt
Tags
auth-bypasspatch-availablepre-authvulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • Lateral MovementRemote Services: SSH

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-11-06/cve-2026-123158-openssh-musl-no-pam-password-bypass-sshole · ATT&CK page ↗

Lateral Movement TA0008

T1021.004Remote Services: SSH×1

Adversaries may use Valid Accounts to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user.

Evidence: 2026-11-06/cve-2026-123158-openssh-musl-no-pam-password-bypass-sshole · ATT&CK page ↗

Entries about OpenSSH Portable before 10.6p2 on musl libc without PAM (*sshole): a password of 257 to 1,024 bytes logs in to accounts whose password field is * (1)

2026-11-06 · view entry permalink →

NOTABLECVE-2026-123158NATOA2

CVE-2026-123158, OpenSSH Portable before 10.6p2 (*sshole): on Linux with musl libc and no PAM, a password of 257 to 1,024 bytes logs in to accounts whose password field is *; NCSC Switzerland issued an advisory (CVSS 3.1 8.1)

Portable OpenSSH 10.6p2, released on 2026-11-05, carries what its release notes call a critical security workaround for Linux systems that use the musl libc with PAM disabled (OpenSSH, 2026-11-05). NCSC Switzerland says remote, unauthenticated attackers can bypass SSH password authentication over the network and gain access, and rates the exploitation status unknown (NCSC Switzerland, 2026-11-05). OX Security explains the mechanism: musl's crypt() refuses inputs over 256 bytes and returns the string * when it fails, * is also what /etc/shadow holds for an account with no valid password, and OpenSSH, whose 2016 user-enumeration countermeasure can hash a password with settings taken from another account, reads the two matching values as a successful login (OX Security, 2026-11-05). OX gives the conditions: sshd on musl without PAM (Alpine's openssh-server by default, or UsePAM no), password logins enabled, an account whose password field is * (key-only users, LDAP users, root on Alpine) and at least one other account on the host with a real password; accounts that hold !, glibc systems, PAM setups, Dropbear and OpenBSD are not affected, and OX scores the flaw CVSS 3.1 8.1 (OX Security, 2026-11-05). On Alpine's official AWS and Azure images the passwordless account is the default alpine user, which can run doas without a password, so the bypass chains to root there (OX Security, 2026-11-05).

The OpenSSH developers do not consider the root cause to lie in OpenSSH (heise online, 2026-11-05), and NCSC Switzerland adds that other software using similar authentication paths may be affected (NCSC Switzerland, 2026-11-05). Alpine pushed the fix to every branch back to 3.16 (edge 10.6_p2-r0, 3.24 10.3_p1-r2, 3.23 10.2_p1-r1, 3.22 10.0_p1-r11, 3.21 9.9_p2-r1, 3.20 9.7_p1-r6, 3.19 9.6_p1-r3, 3.18 9.3_p2-r4, 3.17 9.1_p1-r7, 3.16 9.0_p1-r6) (OX Security, 2026-11-05); on release day other distributions and many OpenSSH download servers still offered 10.6p1 (heise online, 2026-11-05).

Triage: an accepted password login is normal for an account with a real hash; the same event for an account whose password field is * has no benign explanation, because such an account cannot match any password.

Successful exploitation allows remote, unauthenticated attackers to bypass SSH password authentication over the network and gain unauthorized system access.

NCSC Switzerland

This release contains a critical security workaround that affects

OpenSSH project

The vulnerability allows an attacker to authenticate to certain password-disabled accounts using an arbitrary password between 257 and 1,024 bytes long.

OX Security 2026-11-05
vulnerability06 Nov 03:40Zmulti-sourceOpen finding →
Sources: NCSC Switzerland (Security Hub advisory 13155) · OpenSSH project (Portable OpenSSH 10.6p2 release notes) · OX Security · heise online

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • heise.de1 (25%)
  • openssh.org1 (25%)
  • ox.security1 (25%)
  • security-hub.ncsc.admin.ch1 (25%)

External references

NVD · cve.org · CISA KEV

All cited sources (4)