OpenSSH password bypass on musl-based Linux is listed as exploited

Some Linux servers running OpenSSH accept the wrong password. The flaw is tracked as CVE-2026-123158. It was published on November 5, 2026, and OpenSSH released a fix in version 10.6p2 the same day. On November 9, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalog. That listing means CISA has evidence the flaw is being used in real attacks. CISA set a remediation due date of November 12, 2026. The record scores the flaw 8.1 out of 10 on the Common Vulnerability Scoring System, which rates severity, and calls it high.

What to do now

If you run OpenSSH on Linux with musl libc and without PAM, act first. PAM, short for Pluggable Authentication Modules, is the system many Linux distributions use to check logins. Alpine Linux is the example the sources name. The OpenSSH team says to set PasswordAuthentication to no in the sshd configuration, or to disable SSH on those systems, until you can upgrade. Turning off password logins stops attackers from using the flaw, because the flaw sits in the password check. Once the systems are protected, install OpenSSH 10.6p2 or later and confirm the running version. Alpine Linux has published its own advisory and an updated release, so check that channel for your build.

The cause

When a user types a password, the server does not compare it directly with the stored password. It scrambles the typed password with a one-way function and compares the result with a stored hash, which is the scrambled form kept on disk. The flaw is a misreading of that stored value. The OpenSSH team says the root cause lies outside OpenSSH, in the musl C library that the affected systems use. Under certain account setups, passwords in a specific long length range are accepted as correct. The record classes the weakness as CWE-394, an unexpected return value that the software does not check properly.

Who is exposed

The bug affects OpenSSH on Linux systems that use musl libc and do not use PAM for password logins. The OpenSSH team says it does not exist on non-Linux systems, on Linux systems that use glibc, or on Linux systems that use PAM for password authentication. Check your SSH servers, and any containers or appliances built on Alpine or other musl-based images. The sources do not list other affected products. Some third-party projects, including container SSH images, have posted notices, but the sources do not say what those notices cover. Public lab projects built around the flaw are available on GitHub, which lowers the effort needed to test it against your own hosts.

The EPSS model estimates the chance of exploitation in the next 30 days. For this flaw it gives 18.9%. That number is a forecast, not evidence of attacks. The KEV listing is the evidence that exploitation has been seen.

Why the fix came fast

Özgün Kültekin of Wakefield reported the problem to OpenSSH. The OpenSSH maintainers say they learned of it only the day before the release. In their announcement they said they have seen several cases where AI tools found a bug that another researcher later found independently, sometimes within hours. For that reason, they argue that long embargo periods now help attackers more than defenders. They also said they will make more frequent releases for now, so fixes reach users sooner. Expect more small updates from OpenSSH, and build a routine to apply them quickly.