https://www.phllaps.net/tags/openbsd/ Recent content in OpenBSD on PhllapsNET Hugo en-gb Mon, 09 Nov 2026 00:00:00 +0000 https://www.phllaps.net/posts/openbsd-openssh-unexpected-status-code-or-return-value-vulnerability/ Mon, 09 Nov 2026 00:00:00 +0000 https://www.phllaps.net/posts/openbsd-openssh-unexpected-status-code-or-return-value-vulnerability/ <div style="background:#dc2626;color:white;padding:16px 18px;border-radius:14px;font-weight:800;font-size:18px;display:flex;align-items:center;gap:12px;box-shadow:0 10px 24px rgba(0,0,0,0.18);"><span style="font-size:24px;">🚨</span><span>SEVERITY: HIGH — CVSS 8.1</span><span style="opacity:0.95;font-weight:700;margin-left:auto;">Security Advisory</span></div> <h2 id="tldr-">TL;DR 📌</h2> <ul> <li>OpenBSD OpenSSH on Linux contains an unexpected status code or return value vulnerability that could allow for authentication bypass.</li> <li>Highest CVSS: <strong>8.1 (High)</strong>.</li> <li><strong>Listed in CISA KEV</strong> (2026-11-09) — this is being exploited in the wild.</li> <li><strong>Check the advisory for fixed releases</strong> — remediation detail is in the vendor link below.</li> <li>CVEs: CVE-2026-123158.</li> </ul> <h2 id="what-it-is">What it is</h2> <p>CVE-2026-123158 is an authentication bypass in sshd, the OpenSSH server daemon. It affects OpenSSH before 10.6p2 on Linux, specifically when the system uses musl libc instead of glibc and is not configured to use PAM for authentication. Alpine Linux is given as an example of a platform meeting both conditions.</p>