[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f1swmo5IdY-TrvwIVa8dC1-XVFNiPZM5sTRf5wMbkcxQ":3},{"article":4,"iocs":53,"watch_terms":58,"solutions":59,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"06a34e6c-73bc-41ba-9c61-c0ceb499722a","CVE-2026-123158 | OpenSSH musl Password Authentication Bypass & Remote Code Execution Vulnerability (*sshole)","cve-2026-123158-openssh-musl-password-authentication-bypass-remote-code-executio-cc3364","CVE-2026-123158, known as *sshole, is an OpenSSH sshd authentication bypass on Linux systems that use musl libc without PAM, including Alpine Linux in its default configuration.","A critical vulnerability, CVE-2026-123158 (*sshole), affects OpenSSH versions prior to 10.6p2 when used on Linux systems with musl libc and without PAM, such as Alpine Linux and OpenWrt. Attackers can exploit this by sending an overly long password to bypass authentication and execute commands as the affected account, potentially gaining root access. Public proofs of concept exist, and exploitation in the wild has been confirmed.","OpenSSH vulnerability CVE-2026-123158 allows password bypass and RCE on musl libc systems.","https:\u002F\u002Fhorizon3.ai\u002Fattack-research\u002Fvulnerabilities\u002Fcve-2026-123158\u002F","https:\u002F\u002Fhorizon3.ai\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002Fcve-2026-123158-openssh-musl-auth-bypass.png","2026-11-06T23:29:54+00:00","2026-11-07T00:00:02.927696+00:00",9,[17,20,23,25,27],{"name":18,"type":19},"OpenSSH","product",{"name":21,"type":22},"musl libc","technology",{"name":24,"type":19},"Alpine Linux",{"name":26,"type":19},"OpenWrt",{"name":28,"type":29},"Horizon3","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,41,43,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54],{"type":55,"value":56,"context":57},"cve","CVE-2026-123158","OpenSSH musl Password Authentication Bypass & Remote Code Execution Vulnerability",[28,18,24],{"controls":60,"vendors":144},[61,90,115],{"slug":62,"name":63,"problem":64,"products":65},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":91,"name":92,"problem":93,"products":94},"patch-management","Automated patch management","Known holes get closed in days, not months.",[95,99,107],{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":91,"product_name":96,"url":97,"description":98},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":116,"name":117,"problem":118,"products":119},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[120,128,136],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",[],{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":157},"critical-openssh-auth-bypass-on-musl-based-systems-demands-immediate-patching","Critical OpenSSH Auth Bypass on musl-Based Systems Demands Immediate Patching","CVE-2026-123158 (*sshole) exposes a severe flaw in OpenSSH versions prior to 10.6p2 running on musl libc environments—such as Alpine Linux and OpenWrt—where an oversized password string can completely bypass authentication and enable remote code execution, potentially as root. The vulnerability exists because the musl libc implementation handles string operations differently than glibc, creating an exploitable boundary condition in password processing when PAM is not in use. Active exploitation in the wild and public proof-of-concept code mean the window for unpatched systems to be compromised is extremely narrow. This matters because Alpine Linux is widely used in containerized and lightweight infrastructure environments, meaning the blast radius of unpatched deployments could be enormous across cloud-native and embedded systems alike.",[150,151,152,153,154,155,156],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":158,"NIST SP 800-53 SI-2: Flaw Remediation":159,"CIS Control 17: Incident Response Management":160,"OWASP A06:2021 Vulnerable and Outdated Components":161,"CIS Control 7: Continuous Vulnerability Management":162,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":163,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":164},"NIS2 requires essential and important entities to implement incident handling and vulnerability management practices; the confirmed in-the-wild exploitation of this critical flaw would trigger mandatory timely patching and incident response obligations under this article.","SI-2 requires organizations to identify, report, and correct information system flaws within defined time frames; a formal flaw remediation process would have ensured CVE-2026-123158 was patched on all musl-based OpenSSH deployments rapidly after disclosure.","Given that exploitation in the wild is confirmed, organizations need a practiced incident response plan to triage potentially compromised musl-based SSH hosts, contain lateral movement, and recover systems—capabilities CIS Control 17 specifically requires to be pre-established and tested.","This risk category directly applies because the root issue is a vulnerable version of OpenSSH being present in deployed systems; OWASP A06 guidance on inventorying and promptly updating components would have mitigated exposure.","With active exploitation confirmed and public PoCs available, organizations running continuous vulnerability scanning against their musl-based hosts would have identified the unpatched OpenSSH versions and prioritized remediation before attackers could exploit them.","A.8.8 mandates timely identification and remediation of technical vulnerabilities; had organizations applied this control, they would have tracked OpenSSH's affected versions across musl environments and acted on the advisory before in-the-wild exploitation began.","The vulnerability directly bypasses authentication controls; the PR.AA function's requirement to protect authentication mechanisms would prompt organizations to enforce key-based authentication and disable password auth as a compensating control on affected systems."]