OpenSSH Security Restriction Bypass Vulnerability

OpenSSH Security Restriction Bypass Vulnerability

Release Date: 6 Nov 2026

A vulnerability was identified in OpenSSH. A remote attacker could exploit some of these vulnerabilities to trigger security restriction bypass on the targeted system.

 

Note:

Proof-of-concept code is publicly available for CVE-2026-123158. sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). An example of a platform using musl libc without PAM is Alpine Linux. Other mainstream Linux distributions (such as Red Hat, SUSE, Ubuntu and Debian, etc.) utilize the glibc library and are unaffected by this vulnerability.

---

Impact

• Security Restriction Bypass

---

System / Technologies affected

• OpenSSH versions before 10.6p2

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:

• https://www.openssh.org/txt/release-10.6p2

---

Vulnerability Identifier

• CVE-2026-123158

---

Source

• OpenSSH

---

Related Link

• https://www.openssh.org/txt/release-10.6p2
• https://sshhole.com/