Description
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
OhShit! incidents
References
- www.cve.org/CVERecord ↗
- nvd.nist.gov/vuln/detail/CVE-2026-123158 ↗
- github.com/leonjza/sshhole-lab ↗
- github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482 ↗
- github.com/predkambrij/sshhole-repro ↗
- hachyderm.io/@damienmiller/117563026759098135 ↗
- marc.info/ ↗
- news.ycombinator.com/item ↗
- news.ycombinator.com/item ↗
- www.openssh.org/releasenotes.html ↗
- alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/ ↗
- github.com/coollabsio/coolify/discussions/12484 ↗
- github.com/google/goonami-scanner/pull/277 ↗
- github.com/panubo/docker-sshd/issues/93 ↗
- news.ycombinator.com/item ↗
- sshhole.com/ ↗
Related CVEs
← CVE Index: search every CVE from the last 30 days
This product uses the NVD API but is not endorsed or certified by the NVD. CVSS scores do not establish exploitation.