CVE Feed

    Dashboard / CVE / CVE-2026-123158

    CVE-2026-123158

    sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.

    Published:Nov 5, 2026
    Last Modified:Nov 5, 2026
    EPS:Nov 5, 2026
    EPSS Score:
    CVSS Score:8.1

    Affected Products

    Vendor
    Openbsd
    Product
    Openssh

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-106583 (CVSS 2.5) — In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.…
    CVE-2026-106589 (CVSS 2.9) — In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can …
    CVE-2026-106588 (CVSS 3.1) — In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing,…
    CVE-2026-106587 (CVSS 3.6) — In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a file…
    CVE-2026-106586 (CVSS 2.5) — In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tun…
    CVE-2026-106585 (CVSS 6.5) — In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded du…
    CVE-2026-106584 (CVSS 2.5) — In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight S…
    CVE-2026-106582 (CVSS 3.7) — In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicat…
    CVE-2026-106555 (CVSS 2.2) — In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across …
    CVE-2026-106553 (CVSS 2.2) — In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication au…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High