CVE-2026-123158 in OpenSSH
Summary
by MITRE • 11/05/2026
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in OpenSSH versions prior to 10.6p2 represents a critical authentication bypass flaw specifically affecting systems utilizing the musl C library in environments where Pluggable Authentication Modules are not employed, such as Alpine Linux. This issue stems from an incorrect interpretation of string data within the password authentication mechanism, leading to a scenario where valid credentials can be circumvented entirely under specific conditions. The root cause lies in how the sshd daemon processes and validates user-supplied passwords when interacting with musl libc's implementation of cryptographic hashing functions compared to glibc or other alternatives that include PAM integration for enhanced security controls.
In standard Linux distributions using GNU C Library (glibc) combined with PAM, authentication workflows are robustly managed through layered verification steps that validate password hashes against stored credentials securely. However, in configurations relying solely on musl libc without the intermediary layer of PAM, the sshd service encounters a logic error when determining whether an input string constitutes a valid password hash or should be treated as plaintext for hashing and comparison. This misinterpretation allows attackers to exploit a specific range of character lengths between 256 and 1024 characters to bypass authentication checks entirely. When such a long string is submitted, the system fails to properly validate it against stored hashes, effectively granting access without requiring knowledge of the actual password.
This vulnerability falls under CWE-287, which describes Improper Authentication, as well as CWE-693 related to Protection Mechanism Failure due to incorrect interpretation of input data. From a threat modeling perspective aligned with MITRE ATT&CK techniques, this flaw facilitates Account Manipulation and Credential Access by allowing unauthorized users to gain initial access through simple password spraying or brute-force attacks using long dummy strings rather than attempting complex cryptographic cracking methods. The impact is severe because it undermines the fundamental security premise of SSH-based remote administration, potentially exposing sensitive systems to complete compromise if left unpatched in environments where musl libc is prevalent and PAM is disabled for performance or simplicity reasons.
Mitigation strategies primarily involve upgrading OpenSSH to version 10.6p2 or later, which includes specific code adjustments to correctly handle string length checks and hash validation logic within the musl environment. For organizations unable to immediately upgrade due to compatibility constraints, disabling password-based authentication in favor of public key-only access provides a strong compensating control that eliminates reliance on vulnerable password processing paths entirely. Additionally, administrators should review their system configurations to ensure PAM is enabled where possible, as this adds an additional layer of validation and logging that can help detect or prevent exploitation attempts even if the underlying library behavior remains unchanged. Regular auditing of authentication logs for unusual login patterns involving long strings may also aid in early detection of potential exploitation activities targeting this specific flaw.