CVE-2026-123158
OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability
- High 8.1
- Exploited: added to CISA KEV 9 Nov 2026
Description
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
Key facts
- Published
- 5 Nov 2026
- Last changed
- 10 Nov 2026
- Assigned by
- mitre
- KEV added
- 9 Nov 2026
- KEV fix due
- 12 Nov 2026
- EPSS
- 18.9% likely to be exploited in the next 30 days, higher than 97.341% of CVEs (scores for 15 Nov 2026)
- SSVC (CISA)
- Exploitation: active; Automatable: no; Technical impact: total
Severity scores
Each score is shown as its source gave it. They are not averaged or merged.
- 8.1CVSS 3.1, Highfrom the CNA (mitre)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What to do
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.CISA KEV required action
Historical context and remediation
This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.
No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.
Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| OpenBSD | OpenSSH |
|
Timeline
- 5 Nov 2026 Published
- 9 Nov 2026 CVE-2026-123158 added to CISA KEV
- 9 Nov 2026 Added to the CISA KEV catalogue
Weakness
Related coverage
- SSHole OpenSSH flaw exploited in the wild, with a Chinese-language implant among the payloads9 Nov 2026
- Exploitation of SSHole OpenSSH auth bypass has begun, researchers say9 Nov 2026
- SANS honeypots log first sshole exploit attempts, mostly from a handful of scanners8 Nov 2026
- OpenSSH SSHole flaw draws exploit attempts within hours of disclosure7 Nov 2026
- OpenSSH ships 10.6p2 for 'SSHole' auth bypass on musl systems without PAM6 Nov 2026