CVE-2026-123158

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-123158
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-123158.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-123158
Downstream
Published
2026-11-05T15:46:26Z
Modified
2026-11-07T07:12:13Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.

Database specific 
{
    "cna_assigner": "mitre",
    "cwe_ids": [
        "CWE-394"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-123158.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "fixed": "10.6p2"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                }
            ]
        },
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "fixed": "10.6p2"
                        }
                    ],
                    "source": "CPE_FIELD",
                    "strategy": "CPEApplicability"
                }
            ]
        },
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "fixed": "10.6p2"
                        }
                    ],
                    "source": "DESCRIPTION"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/openssh/openssh-portable

Affected ranges

Type
GIT
Repo
https://github.com/openssh/openssh-portable
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4353fdc43ef646c43a8dda7025cc1a898caf1482
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "fixed": "4353fdc43ef646c43a8dda7025cc1a898caf1482"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

Other
ABOUT_TO_ADD_INET_ATON
AFTER_FREEBSD_PAM_MERGE
AFTER_KRB5_GSSAPI_MERGE
BEFORE_FREEBSD_PAM_MERGE
BEFORE_KRB5_GSSAPI_MERGE
POST_KRB4_REMOVAL
PRE-REORDER
PRE_CYGWIN_MERGE
PRE_DAN_PATCH_MERGE
PRE_FIXPATHS_INTEGRATION
PRE_HPUX_INTEGRATION
PRE_IPV6
PRE_KRB4_REMOVAL
PRE_NEW_LOGIN_CODE
PRE_SW_KRBV
V_1_2PRE17
V_1_2_1_PRE18
V_1_2_1_PRE19
V_1_2_1_PRE20
V_1_2_1_PRE21
V_1_2_1_PRE22
V_1_2_1_PRE23
V_1_2_1_PRE24
V_1_2_1_PRE25
V_1_2_1_PRE26
V_1_2_1_PRE27
V_1_2_2
V_1_2_2_P1
V_1_2_2_PRE28
V_1_2_2_PRE29
V_1_2_3
V_1_2_3_PRE1
V_1_2_3_PRE2
V_1_2_3_PRE3
V_1_2_3_PRE4
V_1_2_3_PRE5
V_1_2_3_TEST1
V_1_2_3_TEST2
V_1_2_3_TEST3
V_1_2_PRE10
V_1_2_PRE11
V_1_2_PRE12
V_1_2_PRE13
V_1_2_PRE14
V_1_2_PRE15
V_1_2_PRE16
V_1_2_PRE4
V_1_2_PRE5
V_1_2_PRE6
V_1_2_PRE7
V_1_2_PRE8
V_1_2_PRE9
V_2_0_0_BETA1
V_2_0_0_BETA2
V_2_0_0_TEST1
V_2_1_0
V_2_1_0_P1
V_2_1_0_P2
V_2_1_0_P3
V_2_1_1_P1
V_2_1_1_P2
V_2_1_1_P3
V_2_1_1_P4
V_2_2_0_P1
V_2_3_0_P1
V_2_5_0_P1
V_2_5_1_P1
V_2_5_1_P2
V_2_5_2_P1
V_3_0_1_P1
V_3_0_P1
V_3_1_P1
V_3_2_2_P1
V_3_4_P1
V_3_6_1_P1
V_3_8_P1
V_3_9_P1
V_4_2_P1
V_5_0_P1
V_5_1_P1
V_5_2_P1
V_5_5_P1
V_5_7_P1
V_6_0_P1
V_6_1_P1
V_6_2_P1
V_6_5_P1
V_6_6_P1
V_6_8_P1
V_6_9_P1
V_7_0_P1
V_7_1_P1
V_7_2_P1
V_7_3_P1
V_7_4_P1
V_7_5_P1
V_7_6_P1
V_7_7_P1
V_7_8_P1
V_7_9_P1
V_8_0_P1
V_8_1_P1
V_8_2_P1
V_8_4_P1
V_8_5_P1
V_8_6_P1
V_8_7_P1
V_8_8_P1
V_8_9_P1
V_9_0_P1
V_9_1_P1
V_9_2_P1
V_9_3_P1
V_9_5_P1
V_9_6_P1
V_9_7_P1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-123158.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "299274535873357919814061000225503595385",
                "246061632972874211613635601499433260763",
                "182378301817581421523619250332030347761",
                "318011153068161088951412578136943724818",
                "55899977705282811633425266200951472356",
                "36562908044271608149576910740238067149",
                "61627067735937385258010081808534619152",
                "30209854689963476302298641117150984353",
                "213724054118603080501697524117232632247",
                "132559710136112694186929626686841657749",
                "93216560223540617855735496598438447995",
                "292275490248108786245723196605504990612",
                "215202054095599041132152339011171193965",
                "291771041752777532886078754654901384802",
                "326906850988560835071308195230344132605",
                "164685616268765845636288971588000901968",
                "190820618413795042449286668290111729425",
                "189260965603741422949216815677805969967",
                "132829589594568239824844633161178775831",
                "79304961031213980929124617259500513897"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-123158-099849b0",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482",
        "target": {
            "file": "auth-passwd.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "7908451215502949527849171087239029348",
            "length": 623
        },
        "id": "CVE-2026-123158-3b9af67e",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482",
        "target": {
            "file": "openbsd-compat/xcrypt.c",
            "function": "pick_salt"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "302591427691734518700903337846613876089",
            "length": 747
        },
        "id": "CVE-2026-123158-471857f9",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482",
        "target": {
            "file": "openbsd-compat/port-uw.c",
            "function": "sys_auth_passwd"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "131243414084843808353199017336204382716",
                "51599825052669336441509801383779356786",
                "282462581230683315432047941305519908376",
                "292275490248108786245723196605504990612",
                "215202054095599041132152339011171193965",
                "319587074968861296130439563270605754759",
                "171233612556882632417917085929662389351",
                "145780049850554113636689747415823210062",
                "19661048765142007294786029065919718766",
                "35604775349993073434164538963954248345",
                "254802836512702398545398687199623181343",
                "34838260737518689265743910974709179539",
                "285508486553029525457858858675055825307",
                "52235735116808839859091927384691735052",
                "76073649212343075344696152771504005840",
                "116253335203111912097272351507465743166"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-123158-5e0ae7cf",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482",
        "target": {
            "file": "openbsd-compat/port-uw.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "120754960102051773840336165303348176111",
            "length": 464
        },
        "id": "CVE-2026-123158-73008821",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482",
        "target": {
            "file": "auth-passwd.c",
            "function": "sys_auth_passwd"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "16838443053258748048098277689984865139",
                "135407971627325661684567236449926362398",
                "198455317463077157823534067256434336010",
                "197335363101614841482134729204797440244",
                "272484076610990118560756951786370814883",
                "203161309424969270012874692069694827806",
                "80521320566523701244988850689177406731",
                "132829416642861596024108317655167594053",
                "31101129509597632757883379272268899485",
                "254808784906561128650700666828265621996",
                "70436856183389868918661734590414052830",
                "161234759517520647248482501126807530531",
                "42536073633678216794501509550883617180",
                "109388128052665260361439665827095668367",
                "203927310892268213340004390942418595033",
                "282935975051340330596140153437839812762",
                "7965885211369386998511704656760054191",
                "274194219527338060622750801612369490034",
                "136584274834943319667197962747982595542",
                "217091438975255666339539175757287922928",
                "326550963709329893083470680984191268404",
                "184080311427808386004829028998863473622",
                "102316881203632837619141561513132624013",
                "302766150959126891513506725869053321014",
                "220212570246724356461205414892283497085",
                "191866248399808183760280496014976513708"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-123158-745699f2",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482",
        "target": {
            "file": "openbsd-compat/xcrypt.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "229959672299385289727190592129481811016",
            "length": 610
        },
        "id": "CVE-2026-123158-da913785",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482",
        "target": {
            "file": "openbsd-compat/xcrypt.c",
            "function": "shadow_pw"
        }
    }
]
vanir_signatures_modified 
"2026-11-07T07:12:13Z"