OpenBSD · OpenSSH
CVE-2026-123158
OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability
What it is
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
CISA: OpenBSD OpenSSH on Linux contains an unexpected status code or return value vulnerability that could allow for authentication bypass.
What to do
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Deadline for US federal agencies: November 12, 2026
- Added to the CISA list
- November 9, 2026
- Published
- November 5, 2026
- Severity
- High 8.1 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 19% in the top 2.7% of all known vulnerabilities
- Weakness
- CWE-394
- More details
- NVD · CVE.org · CISA
All references (8)
- https://www.openssh.org/releasenotes.html#10.6p2
- https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482
- https://news.ycombinator.com/item?id=50377976
- https://news.ycombinator.com/item?id=50378228
- https://marc.info/?l=openssh-unix-dev&m=179388064263131&w=2
- https://hachyderm.io/@damienmiller/117563026759098135
- https://github.com/predkambrij/sshhole-repro
- https://github.com/leonjza/sshhole-lab
More exploited flaws from OpenBSD
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Mar 25, 2022 | Remote Code Execution | OpenSMTPD | Critical 9.8 | 99% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.