Password Authentication Bypass in OpenSSH on Linux Systems Using Musl libc

CVE-2026-123158

What is CVE-2026-123158?

A vulnerability has been identified in OpenSSH, specifically for versions prior to 10.6p2, when utilized on Linux systems with musl libc and without PAM. This flaw allows for a password authentication bypass due to the misinterpretation of whether a string is meant to be a password hash. Consequently, on certain account configurations, any password ranging from 256 to 1024 characters may successfully grant access. Systems using musl libc without PAM, such as Alpine Linux, are particularly vulnerable to this issue.

References