CVE-2026-123158
OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability
What is it?
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
Official description from NVD.
What happened
Research from SANS Internet Storm Center honeypots shows a sharp increase in exploitation attempts for the sshole vulnerability (CVE-2026-123158) starting November 1st. Attackers are using unusually long passwords to exploit the flaw, with daily scan counts rising from 23 attempts on November 1st to 713 by November 6th. The attacks coincide with malware distribution campaigns targeting vulnerable systems. Organizations running SSH services should apply patches and monitor for exploitation attempts.
From the Intel60 brief of Nov 8, 2026. AI-written summary: check the sources before acting.
Intel60 briefs
- HighCVE-2026-123158 sshole exploitation rising in SSH attacksNov 8, 2026