Detections
Analytics

OpenSSH < 10.6p2 Authentication Bypass

high Nessus Plugin ID 377050

Synopsis

The SSH server running on the remote host is affected by an authentication bypass vulnerability.

Description

The version of OpenSSH installed on the remote host is prior to 10.6p2. It is, therefore, affected by an authentication bypass vulnerability as referenced in the release-10.6p2 advisory.

 - sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux. (CVE-2026-123158)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to OpenSSH version 10.6p2 or later.

See Also

https://www.openssh.com/txt/release-10.6p2

http://www.nessus.org/u?a448912e

Plugin Details

Severity: High

ID: 377050

File Name: openssh_10_6_p2.nasl

Version: 1.1

Type: Remote

Family: Misc.

Published: 11/6/2026

Updated: 11/6/2026

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 8.9

Percentile: 99.72

CVSS v2

Risk Factor: High

Base Score: 7.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-123158

CVSS v3

Risk Factor: High

Base Score: 8.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: cpe:/a:openbsd:openssh

Required KB Items: installed_sw/OpenSSH

Patch Publication Date: 11/5/2026

Vulnerability Publication Date: 11/5/2026

Reference Information

CVE: CVE-2026-123158