sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.

OpenSSH released 10.6p2 to fix a password authentication bypass in musl-based builds without PAM, such as Alpine Linux. Apply the available patches as soon as possible.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a
    password authentication bypass (related to misinterpretation of whether a string is intended to be a
    password hash). For some configurations of accounts, any password between 256 and 1024 characters
    succeeds. An example of a platform using musl libc without PAM is Alpine Linux. (CVE-2026-123158)

ID	Name	Product	Family	Type	Severity
478610	Alpine: openssh: security update to 10.0_p1-r11	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
478610	Alpine: openssh: security update to 10.0_p1-r11	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
478609	Alpine: openssh: security update to 9.9_p2-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
478609	Alpine: openssh: security update to 9.9_p2-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
478608	Alpine: openssh: security update to 9.6_p1-r3	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
478608	Alpine: openssh: security update to 9.6_p1-r3	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
478607	Alpine: openssh: security update to 9.3_p2-r4	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
478607	Alpine: openssh: security update to 9.3_p2-r4	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
478605	Alpine: openssh: security update to 9.7_p1-r6	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
478605	Alpine: openssh: security update to 9.7_p1-r6	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
478604	Alpine: openssh: security update to 9.1_p1-r7	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
478604	Alpine: openssh: security update to 9.1_p1-r7	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
478603	Alpine: openssh: security update to 10.2_p1-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
478603	Alpine: openssh: security update to 10.2_p1-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
478602	Alpine: openssh: security update to 9.0_p1-r6	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
478602	Alpine: openssh: security update to 9.0_p1-r6	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
478601	Alpine: openssh: security update to 10.3_p1-r2	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
478601	Alpine: openssh: security update to 10.3_p1-r2	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high

Detections

Analytics

CVE-2026-123158

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high