OpenSSH password-auth bypass on musl libc without PAM (Alpine)

high severity · exploited in the wild · published 2026-11-05

An attacker can log in to sshd with any password between 256 and 1024 characters for some account configurations, bypassing password authentication entirely. Exploitation attempts have already been seen in the wild.

Fixed in: 10.6

CVE: CVE-2026-123158

Source: openssh.com

Am I affected?

You are affected if the installed version is older than 10.6. Check the version you have and update to 10.6 or later. The fixed version is verified against a vendor or advisory source.

Get the fix

FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 2458 and your operating system.