---
schema: 1
kind: vulnerability
title: "CVE-2026-123158, OpenSSH Portable before 10.6p2 (*sshole): on Linux with musl libc and no PAM, a password of 257 to 1,024 bytes logs in to accounts whose password field is *; NCSC Switzerland issued an advisory (CVSS 3.1 8.1)"
headline: "OpenSSH 10.6p2: password bypass on musl Linux without PAM (Alpine, OpenWrt); update or turn passwords off"
summary: >
  OpenSSH Portable 10.6p2 of 2026-11-05 works around CVE-2026-123158, a password-authentication bypass on Linux systems that use musl libc and run sshd without PAM, Alpine's default
  OpenSSH server and OpenWrt among them: a password of 257 to 1,024 bytes logs in to an account whose password field is *. NCSC Switzerland published an advisory the same day and rates
  exploitation unknown; Alpine shipped fixed packages for every branch back to 3.16, and no source reports attacks.
discovered_at: "2026-11-06T03:40:00Z"
updated_at: null
event_date: "2026-11-05"
run_id: 2026-11-06T0255Z-intel
priority: notable
immediate_action: null
tags: [vulnerabilities, auth-bypass, pre-auth, patch-available]
regions: [global]
sectors: []
entities: ["product:openssh", "product:alpine-linux", "product:openwrt"]
techniques: [T1190, T1021.004]
affected_products: ["OpenSSH", "Alpine Linux", "OpenWrt"]
cves:
  - id: CVE-2026-123158
    cvss: "8.1"
    epss: null
    type: auth-bypass
    vector: zero-click
    auth: pre-auth
    status: [patch-available]
    affected: "OpenSSH Portable before 10.6p2 on Linux with musl libc and no PAM; needs an account whose password field is * and at least one other account with a real password"
    fixed: "OpenSSH Portable 10.6p2; Alpine edge 10.6_p2-r0, 3.24 10.3_p1-r2, 3.23 10.2_p1-r1, 3.22 10.0_p1-r11, 3.21 9.9_p2-r1, 3.20 9.7_p1-r6, 3.19 9.6_p1-r3, 3.18 9.3_p2-r4, 3.17 9.1_p1-r7, 3.16 9.0_p1-r6 per OX Security; temporary mitigation PasswordAuthentication no"
sources:
  - url: "https://security-hub.ncsc.admin.ch/#/posts/13155"
    publisher: "NCSC Switzerland (Security Hub advisory 13155)"
    date: "2026-11-05"
    role: primary
  - url: "https://www.openssh.org/txt/release-10.6p2"
    publisher: "OpenSSH project (Portable OpenSSH 10.6p2 release notes)"
    date: "2026-11-05"
    role: primary
  - url: "https://www.ox.security/blog/openssh-authentication-bypass-cve-2026-123158/"
    publisher: "OX Security"
    date: "2026-11-05"
    role: corroborating
  - url: "https://www.heise.de/en/news/OpenSSH-and-Alpine-Linux-warn-of-severe-but-niche-bug-11513360.html"
    publisher: "heise online"
    date: "2026-11-05"
    role: corroborating
closed_sources: []
evidence:
  - quote: "Successful exploitation allows remote, unauthenticated attackers to bypass SSH password authentication over the network and gain unauthorized system access."
    publisher: "NCSC Switzerland"
    source_url: "https://security-hub.ncsc.admin.ch/#/posts/13155"
  - quote: "This release contains a critical security workaround that affects"
    publisher: "OpenSSH project"
    source_url: "https://www.openssh.org/txt/release-10.6p2"
  - quote: "The vulnerability allows an attacker to authenticate to certain password-disabled accounts using an arbitrary password between 257 and 1,024 bytes long."
    publisher: "OX Security"
    source_url: "https://www.ox.security/blog/openssh-authentication-bypass-cve-2026-123158/"
verification: multi-source
sourcing_note: >
  OX Security's analysis is the source of the mechanism, the condition that an account's password field is `*`, the CVSS score and the Alpine fixed-package table; NCSC Switzerland's advisory and the project's release notes do not carry them. NCSC Switzerland restates the vendor's release, and no source reports exploitation.
confidence: high
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: A
  credibility: 2
watchlist_hit: false
actions:
  - "On every musl-based Linux host that runs sshd (Alpine, OpenWrt, Buildroot, Yocto), install OpenSSH 10.6p2 or the distribution's fixed openssh package and restart sshd, because updating the package does not replace the running server, and rebuild container and cloud images from a fixed base; until then set PasswordAuthentication no in sshd_config and restart sshd."
updates: []
migrated_from: null
---

Portable OpenSSH 10.6p2, released on 2026-11-05, carries what its release notes call a critical security workaround for Linux systems that use the musl libc with PAM disabled ([OpenSSH, 2026-11-05](https://www.openssh.org/txt/release-10.6p2)). NCSC Switzerland says remote, unauthenticated attackers can bypass SSH password authentication over the network and gain access, and rates the exploitation status unknown ([NCSC Switzerland, 2026-11-05](https://security-hub.ncsc.admin.ch/#/posts/13155)). OX Security explains the mechanism: musl's crypt() refuses inputs over 256 bytes and returns the string `*` when it fails, `*` is also what /etc/shadow holds for an account with no valid password, and OpenSSH, whose 2016 user-enumeration countermeasure can hash a password with settings taken from another account, reads the two matching values as a successful login ([OX Security, 2026-11-05](https://www.ox.security/blog/openssh-authentication-bypass-cve-2026-123158/)). OX gives the conditions: sshd on musl without PAM (Alpine's openssh-server by default, or UsePAM no), password logins enabled, an account whose password field is `*` (key-only users, LDAP users, root on Alpine) and at least one other account on the host with a real password; accounts that hold `!`, glibc systems, PAM setups, Dropbear and OpenBSD are not affected, and OX scores the flaw CVSS 3.1 8.1 ([OX Security, 2026-11-05](https://www.ox.security/blog/openssh-authentication-bypass-cve-2026-123158/)). On Alpine's official AWS and Azure images the passwordless account is the default alpine user, which can run doas without a password, so the bypass chains to root there ([OX Security, 2026-11-05](https://www.ox.security/blog/openssh-authentication-bypass-cve-2026-123158/)).

The OpenSSH developers do not consider the root cause to lie in OpenSSH ([heise online, 2026-11-05](https://www.heise.de/en/news/OpenSSH-and-Alpine-Linux-warn-of-severe-but-niche-bug-11513360.html)), and NCSC Switzerland adds that other software using similar authentication paths may be affected ([NCSC Switzerland, 2026-11-05](https://security-hub.ncsc.admin.ch/#/posts/13155)). Alpine pushed the fix to every branch back to 3.16 (edge 10.6_p2-r0, 3.24 10.3_p1-r2, 3.23 10.2_p1-r1, 3.22 10.0_p1-r11, 3.21 9.9_p2-r1, 3.20 9.7_p1-r6, 3.19 9.6_p1-r3, 3.18 9.3_p2-r4, 3.17 9.1_p1-r7, 3.16 9.0_p1-r6) ([OX Security, 2026-11-05](https://www.ox.security/blog/openssh-authentication-bypass-cve-2026-123158/)); on release day other distributions and many OpenSSH download servers still offered 10.6p1 ([heise online, 2026-11-05](https://www.heise.de/en/news/OpenSSH-and-Alpine-Linux-warn-of-severe-but-niche-bug-11513360.html)).

**Exposure:** sshd on a musl-based Linux system built without PAM, which NCSC Switzerland lists as Alpine, KISS, Sabotage, OpenWrt, Morpheus and other musl distributions that do not use PAM for password authentication, with password logins enabled ([NCSC Switzerland, 2026-11-05](https://security-hub.ncsc.admin.ch/#/posts/13155)) and, per OX Security, an account whose /etc/shadow password field is a literal `*` ([OX Security, 2026-11-05](https://www.ox.security/blog/openssh-authentication-bypass-cve-2026-123158/)). Containers that do not run an OpenSSH server are not affected ([OX Security, 2026-11-05](https://www.ox.security/blog/openssh-authentication-bypass-cve-2026-123158/)).

**Detection:** OX Security advises searching /var/log/messages for `Accepted password for` on an account that has no password (alpine, root, key-only users) and treating the machine as compromised if one is found ([OX Security, 2026-11-05](https://www.ox.security/blog/openssh-authentication-bypass-cve-2026-123158/)). The mechanism implies the same event in any sshd authentication log; no source publishes an indicator beyond that.

**Triage:** an accepted password login is normal for an account with a real hash; the same event for an account whose password field is `*` has no benign explanation, because such an account cannot match any password.

**Defender takeaway:** install OpenSSH 10.6p2 or the distribution's fixed package on every musl-based host that runs sshd and restart sshd, because updating the package alone does not replace the SSH server that is already running, and rebuild container and cloud images from a fixed base ([OX Security, 2026-11-05](https://www.ox.security/blog/openssh-authentication-bypass-cve-2026-123158/)); until then set `PasswordAuthentication no` and restart sshd, as NCSC Switzerland advises ([NCSC Switzerland, 2026-11-05](https://security-hub.ncsc.admin.ch/#/posts/13155)). A host that allowed password logins on an affected build before patching warrants a review of its accepted password logins for key-only accounts.