OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability

🚨SEVERITY: HIGH — CVSS 8.1Security Advisory

TL;DR 📌

  • OpenBSD OpenSSH on Linux contains an unexpected status code or return value vulnerability that could allow for authentication bypass.
  • Highest CVSS: 8.1 (High).
  • Listed in CISA KEV (2026-11-09) — this is being exploited in the wild.
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-123158.

What it is

CVE-2026-123158 is an authentication bypass in sshd, the OpenSSH server daemon. It affects OpenSSH before 10.6p2 on Linux, specifically when the system uses musl libc instead of glibc and is not configured to use PAM for authentication. Alpine Linux is given as an example of a platform meeting both conditions.

The flaw is in how sshd interprets password hashes during authentication. On affected configurations, some accounts will accept any password between 256 and 1024 characters in length, regardless of what the actual password is. This is a misinterpretation bug rather than a cryptographic weakness — sshd is reading something as a successful hash match when it should not.

The access path is the network-facing SSH service itself: no prior authentication or user interaction is required (PR:N, UI:N in the vector), and the attack is remote (AV:N). The high attack complexity (AC:H) reflects that the target must be running the specific combination of musl libc without PAM, and the bypass depends on account configuration — it is not universal across all sshd deployments. Where it applies, the result is full compromise of confidentiality, integrity and availability, consistent with gaining a working shell session as the targeted account.

This CVE is listed in CISA’s Known Exploited Vulnerabilities catalogue, added 9 November 2026.

What to do

  • Identify any Linux hosts running OpenSSH where the C library is musl (Alpine Linux is the stated example) and PAM is not in use for authentication. These are the only systems in scope.
  • Upgrade sshd to 10.6p2 or later. The advisory does not list a fixed release beyond 10.6p2, so treat that as the target version.
  • If immediate upgrade isn’t possible, review which accounts on affected hosts use password authentication rather than keys — switching to key-based authentication removes the password-hash misinterpretation path entirely.
  • Check sshd_config for PasswordAuthentication and consider disabling it on exposed hosts until patched, since the bypass only applies to password-based logins.
  • Given the KEV listing, prioritise this patch on any internet-facing or otherwise reachable sshd instances over routine patch cycles.

For leadership 🧭

Executive summary. Internet-facing Linux servers running OpenSSH with musl libc and no PAM — Alpine Linux being the named example — can be logged into remotely without a correct password, giving an attacker a working shell. This is already listed in CISA’s catalogue of known exploited vulnerabilities, so affected hosts need patching ahead of normal cycles.

Why it matters:

  • The bypass sits in sshd’s password-hash comparison logic, so any account using password authentication on a musl/no-PAM host (e.g. Alpine Linux) can be accessed with a long, arbitrary password rather than the real one.
  • No prior credentials or user interaction are needed — the attack goes straight over the network SSH port, and a successful attempt yields full account access (confidentiality, integrity and availability impact).
  • CISA added this to its Known Exploited Vulnerabilities catalogue on 9 November 2026, meaning it is being used in the wild, not just theoretical.
  • The scope is narrow but easy to miss: standard glibc-based distributions and PAM-configured sshd are not affected, so the risk concentrates on container images and minimal Linux builds (Alpine and similar) that teams may not track as closely as mainstream servers.

Now / Next / Later:

  • Now: Inventory Linux hosts and container images for musl libc (Alpine Linux being the stated example) running sshd without PAM, and treat any that accept password authentication as immediately exposed.
  • Next: Upgrade sshd to 10.6p2 or later on every host identified as in-scope, prioritising internet-reachable or otherwise exposed instances given the active KEV listing.
  • Later: Move affected accounts to key-based authentication and disable PasswordAuthentication in sshd_config by default on musl/no-PAM builds, so this class of password-handling bug cannot be reintroduced.

Source