CVE-2026-123158 SSHole: OpenBSD OpenSSH Unexpected Status Code or Return Value
- Exploited in the wild
- Since 9 Nov 2026
- Fix
- Available
What is CVE-2026-123158?
CVE-2026-123158 (SSHole) is a high-severity vulnerability in OpenSSH, published on 5 Nov 2026.
Official description
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
Weakness: CWE-394
Which versions are affected by CVE-2026-123158?
It affects 1 product.
Products include OpenSSH.
How do I fix CVE-2026-123158?
Upgrade to a fixed version. US federal agencies must fix it by 12 Nov 2026.
Is CVE-2026-123158 being exploited?
Yes. Attackers have exploited CVE-2026-123158 in the wild since at least 9 Nov 2026.
Public exploit code: 38 proofs of concept on GitHub.
Other vulnerabilities in OpenSSH
- CVE-2003-0786 The SSH1 PAM challenge response authentication in OpenSSH 3.7.1 and 3.7.1p1, when Privilege Separation is disabled, does not check the resul
- CVE-2003-0693 A "buffer management error" in buffer_append_space of buffer.c for OpenSSH before 3.7 may allow remote attackers to execute arbitrary code b
- CVE-2002-0640 Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses du
- CVE-2001-0144 CORE SDI SSH1 CRC-32 compensation attack detector allows remote attackers to execute arbitrary commands on an SSH server or client via an integer overflow.
- CVE-2000-0999 Format string vulnerabilities in OpenBSD ssh program (and possibly other BSD-based operating systems) allow attackers to gain root privileges.
Sources
Also known as ALPINE-CVE-2026-123158, AZL-112871, BELL-CVE-2026-123158, DEBIAN-CVE-2026-123158, ECHO-fc8a-d0e0-9786, GHSA-4fcc-vm97-gx3x and 1 more.