CVE-2026-123158 | OpenSSH musl Password Authentication Bypass & Remote Code Execution Vulnerability (*sshole)
OpenSSH vulnerability CVE-2026-123158 allows password bypass and RCE on musl libc systems.
Run Horizon3?
Get an email when a reviewed story names Horizon3, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
A critical vulnerability, CVE-2026-123158 (*sshole), affects OpenSSH versions prior to 10.6p2 when used on Linux systems with musl libc and without PAM, such as Alpine Linux and OpenWrt. Attackers can exploit this by sending an overly long password to bypass authentication and execute commands as the affected account, potentially gaining root access. Public proofs of concept exist, and exploitation in the wild has been confirmed.
The lesson from this incident
Full lessonCVE-2026-123158 (*sshole) exposes a severe flaw in OpenSSH versions prior to 10.6p2 running on musl libc environments—such as Alpine Linux and OpenWrt—where an oversized password string can completely bypass authentication and enable remote code execution, potentially as root. The vulnerability exists because the musl libc implementation handles string operations differently than glibc, creating an exploitable boundary condition in password processing when PAM is not in use. Active exploitation in the wild and public proof-of-concept code mean the window for unpatched systems to be compromised is extremely narrow. This matters because Alpine Linux is widely used in containerized and lightweight infrastructure environments, meaning the blast radius of unpatched deployments could be enormous across cloud-native and embedded systems alike.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
- cve — CVE-2026-123158