Detections
Analytics

CVE-2026-123158

high

Description

sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.

References

https://thehackernews.com/2026/11/hackers-exploited-openssh-sshole-flaw.html

https://www.ox.security/blog/openssh-authentication-bypass-cve-2026-123158/

https://github.com/Funcan/sshole

https://github.com/lpizziniacofortinet/cve-2026-123158-openssh-musl-lab

https://github.com/shenxianpeng/check-sshole

https://github.com/mlazzarotto/ansible-sshole-remediate

https://github.com/techdevfun/alpinegate

https://github.com/techtaek77/sshole-guide

https://github.com/ansonhsu-ai/sshhole-cve-2026-123158-ste

https://github.com/rothoma2/cve-2026-123158-sshole

https://github.com/The-DevOps-Daily/alpine-sshd-check

https://github.com/0xBlackash/CVE-2026-123158

https://github.com/coboliqcom/cve-2026-123158-sshole-safe-rust

https://www.openssh.org/releasenotes.html#10.6p2

https://sshhole.com

https://news.ycombinator.com/item?id=50379704

https://news.ycombinator.com/item?id=50378228

https://news.ycombinator.com/item?id=50377976

https://marc.info/?l=openssh-unix-dev&m=179388064263131&w=2

https://hachyderm.io/@damienmiller/117563026759098135

https://github.com/predkambrij/sshhole-repro

https://github.com/panubo/docker-sshd/issues/93

https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482

https://github.com/leonjza/sshhole-lab

https://github.com/google/goonami-scanner/pull/277

https://github.com/coollabsio/coolify/discussions/12484

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-117552

https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/

Details

Source: Mitre, NVD

Published: 2026-11-05

Updated: 2026-11-08

Named Vulnerability: ssholeNamed Vulnerability: SSHoleNamed Vulnerability: *sshole

Risk Information

CVSS v2

Base Score: 7.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 8.1

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: High

EPSS

EPSS: 0.01014

Vulnerability Watch

Tenable Research has classified this CVE under the following Vulnerability Watch classification, which includes active and historical (inactive) classifications. You can learn more about these classifications on our blog.

Vulnerability of Interest