CVE-2026-123158

CVE Enrichment

CVSS: 8.1 HIGH
EPSS: 0.98%
EPSS Percentile: 62.28%
CISA KEV: Not listed

Description

sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 05-Nov-2026 23:17
Last Modified: 06-Nov-2026 12:18
EPSS Date: 2026-11-06
CWE: CWE-394

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:H /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CNA Products / Version Status

OpenBSD · OpenSSH Source: CNA · [email protected]
Default status: unaffected

0 ≤ version < 10.6p2 — affected (custom)

Platforms: Linux

References

Last enrichment sync: 06-Nov-2026 21:49
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (3)

The vulnerability, tracked as CVE-2026-123158 (CVSS score: 8.1) and codenamed SSHole (or *sshole), impacts Linux systems that run OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled, SSHole OpenSSH Flaw Exploited Within Hours; Alpine Honeypot Saw Root Access
Dubbed SSHole and tracked as CVE-2026-123158 (CVSS score of 8.1), the security defect affects the OpenSSH server (sshd) on Linux distributions that use the musl libc implementation with the Pluggable Authentication OpenSSH Patches SSHole Authentication Bypass Affecting Some Linux Configurations
Tracked as CVE-2026-123158 and dubbed SSHhole, the flaw carries a CVSS 3.1 score of 8.1 and primarily impacts Linux environments where sshd is linked against musl libc and operates without PAM. OpenSSH Password-Authentication Bypass Affects Certain musl-Based Linux Systems

People (5)

MITRE ATT&CK (4)

Vendors (2)

Products (3)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.