OpenSSH auth bypass, actively exploited (CVE-2026-123158) [PoC]

Actively exploited in the wild - CVE-2026-123158 is a high-severity authentication bypass in OpenSSH sshd before 10.6p2 on Linux running musl libc without PAM that lets an attacker log in with any password between 256 and 1024 characters. Patched in OpenSSH 10.6p2 - update now, and treat any affected musl-based host as potentially compromised.

Overview

OpenSSH’s sshd checks a password by comparing it against the account’s stored hash. On some account configurations, a string of the wrong kind (one not intended to be a password hash) is misinterpreted, so the comparison treats the login as a match. The upshot: instead of the real password, any password of 256 to 1024 characters succeeds.

The bug only bites a specific stack: Linux with musl libc and no PAM. Alpine Linux is the canonical example, but any minimal container image or appliance built on musl without pluggable authentication qualifies. Glibc-based distributions and musl systems with PAM configured are not affected.

CVSS scores this 8.1 (High): network attack vector, no privileges, no user interaction, but High attack complexity because the exploit depends on the account configuration and a long password. That complexity is cold comfort once an attacker knows which accounts qualify.

Impact

The consequence is direct: remote, unauthenticated logon. An attacker who can reach port 22 and knows a valid username on an affected host gets a full shell as that user. From there it is standard post-exploitation - reading keys, moving laterally, planting persistence. OpenSSH is the front door of most Linux estates, and musl-based images are increasingly common in containers and edge devices, which widens the blast radius well beyond traditional servers.

Remediation and Mitigation

• Patch: upgrade to OpenSSH 10.6p2 or later. This is the only complete fix.
• Alpine Linux: update the openssh package (apk update && apk upgrade openssh) and rebuild any container images pinned to older bases.
• Short-term mitigation: enable PAM in sshd, or disable password authentication entirely in favor of keys (PasswordAuthentication no). Both close the bypass.
• Detection: hunt sshd logs for logins with unusually long password attempts, and audit accounts with password auth enabled. Rotate credentials and keys on any host that ran an affected build.
• Exposure: scan for musl-based hosts with sshd reachable from untrusted networks; these should be top of your queue.

This is a confirmed, actively exploited issue. Patching is not optional housekeeping.

Security Insight

This flaw is a textbook example of how a portability edge case - what happens when a robust glibc-and-PAM assumption meets a leaner musl build - becomes an exploitable bypass. It echoes the SSHole OpenSSH flaw used to breach Linux systems, where a well-understood, widely deployed daemon turned out to have a subtle authentication weakness. OpenSSH’s long record of stability is real, but its enormous install base means every assumption baked into a niche configuration is a potential front door. Treat nonstandard libc and auth stacks as higher-risk, and pair Linux kernel KEV watch with SSH-surface hardening rather than assuming the daemon is always trustworthy.

Further Reading

• OpenSSH SSHole exploited to breach Linux systems
• CISA adds Linux kernel CVE-2025-39682 to KEV catalog
• CISA Adds Actively Exploited Linux Root Bug CVE-2026-31
• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs