CVE-2026-123158: OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability
In CISA’s Known Exploited Vulnerabilities catalog: OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability.
Added , federal remediation due . Known ransomware use: Unknown.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Description
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · CWE-394
Status incidents that name it
- Linode (Akamai) Customer Security Advisory: OpenSSH Password Authentication Bypass Vulnerability [CVE-2026-123158]· No impact listed · says not affected (notice says “not affected”)
“Customer Security Advisory: OpenSSH Password Authentication Bypass Vulnerability [CVE-2026-123158] Akamai is aware of the password authentication bypass vulnerability affecting certain Linux systems using musl libc…”
Affected vendors and products
OpenBSD: OpenSSH
References
- CVE record on cve.org (opens in new tab)
- NVD entry (opens in new tab)
- github.com/leonjza/sshhole-lab (opens in new tab)
- github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1… (opens in new tab)
- github.com/predkambrij/sshhole-repro (opens in new tab)
- hachyderm.io/@damienmiller/117563026759098135 (opens in new tab)
- marc.info (opens in new tab)
- news.ycombinator.com/item (opens in new tab)
- news.ycombinator.com/item (opens in new tab)
- www.openssh.org/releasenotes.html (opens in new tab)
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)