{"basis":"claimed","id":"CVE-2026-123158","name":"OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability","vendorProject":"OpenBSD","product":"OpenSSH","publishedAt":"2026-11-05","cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"exploited":{"kevAdded":"2026-11-09","dueDate":"2026-11-12","ransomware":false},"epss":{"score":0.01014,"percentile":0.63469,"date":"2026-11-08"},"coverage":{"cloudflare":{"status":"none","firstOn":null,"daysToRule":null},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"none","firstOn":null,"daysToRule":null},"fastly":{"status":"none","firstOn":null,"daysToRule":null},"vercel":{"status":"none","firstOn":null,"daysToRule":null},"f5":{"status":"none","firstOn":null,"daysToRule":null},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":null,"description":"sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.","cwes":["CWE-394"],"vendors":[{"vendor":"cloudflare","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"vercel","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-09T20:17:38.394Z","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","ssvc":null,"kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","kevNotes":"This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://www.openssh.org/releasenotes.html ; https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/ ; https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-123158","references":[{"url":"https://www.openssh.org/releasenotes.html#10.6p2","name":null,"tags":[]},{"url":"https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482","name":null,"tags":[]},{"url":"https://news.ycombinator.com/item?id=50377976","name":null,"tags":[]},{"url":"https://news.ycombinator.com/item?id=50378228","name":null,"tags":[]},{"url":"https://marc.info/?l=openssh-unix-dev&m=179388064263131&w=2","name":null,"tags":[]},{"url":"https://hachyderm.io/@damienmiller/117563026759098135","name":null,"tags":[]},{"url":"https://github.com/predkambrij/sshhole-repro","name":null,"tags":[]},{"url":"https://github.com/leonjza/sshhole-lab","name":null,"tags":[]}],"affected":[{"vendor":"OpenBSD","product":"OpenSSH","affected":["before 10.6p2"],"fixed":[]}],"briefing":{"status":{"id":"known_exploited","label":"Known exploited"},"why":"CISA lists CVE-2026-123158 as exploited in the wild since 2026-11-09. It is reachable over the network without credentials or any user interaction (CVSS 8.1). 8 public exploit repositories are on GitHub (unvetted). No edge WAF vendor names it in a changelog, so default managed rules may or may not catch it.","who":"Teams running OpenBSD OpenSSH (before 10.6p2). Prioritise internet-facing instances.","what_to_do":[{"text":"Find the version you run. On the host:","command":{"where":"On the host","command":"ssh -V"}},{"text":"Apply the vendor's fix; the advisory lists the affected and fixed versions.","href":"https://www.openssh.org/releasenotes.html","linkText":"openssh.org"},{"text":"CISA's required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. US federal agencies must act by 2026-11-12."},{"text":"Review exposed instances for signs of compromise: it was exploited before many systems were patched, and a later patch does not undo access already gained."},{"text":"Do not rely on WAF defaults: no edge vendor names this CVE. Restrict access to the vulnerable component or add a custom rule until it is patched.","href":"#edge","linkText":"Edge coverage"},{"text":"Check which WAF sits in front of your site and whether it covers this CVE.","href":"#check","linkText":"Check your domain"}],"evidence":[{"heading":"CVE record","text":"CVSS 3.1 8.1 (high). Weakness: CWE-394.","links":[{"label":"CVE-2026-123158","href":"https://www.cve.org/CVERecord?id=CVE-2026-123158"},{"label":"NVD","href":"https://nvd.nist.gov/vuln/detail/CVE-2026-123158"}]},{"heading":"Vendor advisory","text":"Fixes and mitigations the CVE record links to. Check affected builds against the vendor, including backports.","links":[{"label":"openssh.org","href":"https://www.openssh.org/releasenotes.html"},{"label":"alpinelinux.org","href":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/"},{"label":"github.com","href":"https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482"},{"label":"cisa.gov","href":"https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk"}]},{"heading":"Exploit evidence","text":"8 GitHub repositories claim exploit code (unvetted; don't run).","links":[{"label":"Exploit repositories","href":"#exploits"}]},{"heading":"Seen exploited","text":"Listed in an independent exploited-vulnerability catalog on 7 Nov 2026. Claimed in 2 Telegram posts (unverified).","links":[]},{"heading":"CISA KEV","text":"Added 2026-11-09, federal due date 2026-11-12 (catalog 2026.11.09, checked 2026-11-09).","links":[{"label":"CISA KEV catalog","href":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-123158"}]},{"heading":"EPSS","text":"1.01% probability of exploitation activity in the next 30 days, higher than 63% of CVEs (2026-11-08).","links":[{"label":"FIRST EPSS","href":"https://api.first.org/data/v1/epss?cve=CVE-2026-123158"}]},{"heading":"WAF vendor statements","text":"No edge vendor changelog names it.","links":[]}],"agent_prompt":"Assess whether the infrastructure available to you is affected by CVE-2026-123158 (OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability). Perform a read-only assessment within your authorized access. Do not send exploit traffic, scan third-party systems, change configuration or restart services.\n\n1. Verify the CVE record at https://www.cve.org/CVERecord?id=CVE-2026-123158 and the vendor advisory. Establish affected and fixed versions, including vendor backports. The record lists: OpenBSD OpenSSH: affected before 10.6p2. Cite sources and retrieval dates; flag anything you cannot verify.\n2. Inventory deployments of OpenBSD OpenSSH: asset, environment, owner where known, installed version or build, and how you confirmed it (package metadata, a version endpoint, image tags), e.g. `ssh -V` (on the host). An image tag alone does not prove the running version.\n3. Identify which deployments are reachable from the internet or untrusted networks, and through which paths (direct origin, load balancer, CDN or WAF).\n4. Assess compensating controls separately from patch status. Current edge WAF coverage for this CVE: no edge WAF vendor names it. Live data: https://cve.vigilbase.com/api/v1/cves/CVE-2026-123158. Check whether the rule is enabled and in block mode on each path, and whether any path bypasses the WAF. A WAF rule is not a patch.\n5. It is known exploited (CISA KEV): review logs on exposed instances for signs of exploitation before and after patching.\n\nReturn a short summary and a table: asset | version/build | assessment (affected, fixed, not applicable, unknown) | exposure | compensating control | evidence | next action. List what you could not assess and the access needed to resolve it. Do not infer absence of compromise from patch status or a lack of alerts.\n\nRemediation guidance: Apply the vendor's fix; the advisory lists the affected and fixed versions. CISA's required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. US federal agencies must act by 2026-11-12.\nMore: https://cve.vigilbase.com/cve/CVE-2026-123158"},"measured":[],"sightings":{"honeypot":null,"catalog":"2026-11-07","reports":[],"telegram":{"posts":2,"last":"2026-11-08"},"days":{"honeypot":[],"reports":[],"telegram":["2026-11-06","2026-11-08"]}},"social":{"total":542,"first_seen":"2026-11-05T16:05:51.000Z","daily":[{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":0},{"day":"2026-11-03","posts":0},{"day":"2026-11-04","posts":0},{"day":"2026-11-05","posts":51},{"day":"2026-11-06","posts":213},{"day":"2026-11-07","posts":101},{"day":"2026-11-08","posts":52},{"day":"2026-11-09","posts":125}],"top_posts":[{"source":"x","kind":"post","url":"https://x.com/AlAssaf_H/status/2119328462527758526","author":"AlAssaf_H","author_name":"Huda","avatar_url":"https://pbs.twimg.com/profile_images/2113847194352492544/0j9aLGPW_bigger.jpg","text":"SSHole (CVE-2026-123158): pre-auth SSH bypass on OpenSSH/musl, no PAM.\n\nWith credential auth enabled, a \"*\" shadow entry and another \"$5$\"/\"$6$\" hash, a 257–1024-byte input makes \"crypt()\" return \"*\"—accepted as a match.\n\nFix: 10.6p2 / backports.\n\nNuclei PR:","engagement":3,"posted_at":"2026-11-08T07:17:35.000Z"},{"source":"x","kind":"post","url":"https://x.com/Habeangorishere/status/2119370733898121497","author":"Habeangorishere","author_name":"Amir","avatar_url":"https://pbs.twimg.com/profile_images/1999813754528104448/uI2wMea2_bigger.jpg","text":"برادر در حال نفوذ به قلب دختر مردم، با آسیب‌پذیری اخیر  CVE-2026-123158 🫡 https://t.co/6R87txLz3m","engagement":2,"posted_at":"2026-11-08T10:05:33.000Z"},{"source":"x","kind":"post","url":"https://x.com/GreyNoiseIO/status/2118820867493056753","author":"GreyNoiseIO","author_name":"GreyNoise","avatar_url":"https://pbs.twimg.com/profile_images/1693735513323442176/x3aY9aAN_bigger.jpg","text":"GreyNoise is monitoring scanning, exploitation attempts, and successful exploitation of SSHole, an OpenSSH flaw affecting musl-based Linux systems like Alpine. CVE-2026-123158 (CVSS 8.1) is trivial to exploit and working exploits are publicly available.\n\nSee what we’re observing…","engagement":2,"posted_at":"2026-11-06T21:40:35.000Z"},{"source":"x","kind":"post","url":"https://x.com/SixHackAcademy/status/2118668110735765558","author":"SixHackAcademy","author_name":"SixHack Academy","avatar_url":"https://pbs.twimg.com/profile_images/2044786289992478720/YrKPWlpp_bigger.jpg","text":"En las últimas horas se está hablando bastante de CVE-2026-123158, un bypass de autenticación que afecta a determinadas configuraciones de OpenSSH sobre musl Linux.\n\nDesde SixHack Academy hemos preparado un análisis técnico completo 👇\n\nhttps://t.co/g9Nr6kl7bf\n\n#OpenSSH  #CVE","engagement":2,"posted_at":"2026-11-06T11:33:35.000Z"},{"source":"mastodon","kind":"post","url":"https://infosec.exchange/@ssvc/117587842105930939","author":"ssvc@infosec.exchange","author_name":"ssvc","avatar_url":"https://files.mastodon.social/cache/accounts/avatars/117/203/139/887/319/637/original/33460e719b503ab7.png","text":"Placeholder for future CISA blog post: https://www. cisa.gov/news-events/alerts/20 26/11/09/cisa-adds-three-known-exploited-vulnerabilities-catalog KEV Catalog already shows 3 new CVEs: CVE-2026-116779 SignalWire FreeSwitch Code Injection Vulnerability CVE-2026-123158 (aka sshho…","engagement":1,"posted_at":"2026-11-09T18:14:39.000Z"},{"source":"mastodon","kind":"post","url":"https://infosec.exchange/@axnews/117587810491335351","author":"axnews@infosec.exchange","author_name":"AX-NEWS CVE watch","avatar_url":"https://files.mastodon.social/cache/accounts/avatars/117/517/993/482/474/488/original/755284c2a7907606.png","text":"⚠️ Exploited in the wild: CVE-2026-123158 OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability Added to CISA KEV · High 8.1 Impacted if: OpenBSD OpenSSH < 10.6p2 https:// ax-news.com/cve/CVE-2026-123158 # CVE # KEV # infosec","engagement":1,"posted_at":"2026-11-09T18:06:36.000Z"},{"source":"x","kind":"post","url":"https://x.com/denizhalilT/status/2119844383344243031","author":"denizhalilT","author_name":"Halil Deniz","avatar_url":"https://pbs.twimg.com/profile_images/1740366291586703360/5bGofEkG_bigger.jpg","text":"🚨 New root vulnerability discovered!\n\nSSHole (CVE-2026-123158) severely impacts Alpine Linux. Read the full analysis to protect your server today! \nhttps://t.co/CwhsuX3fwc \n\n#AlpineLinux #CVE #Linux https://t.co/gvpAnxXQQD","engagement":1,"posted_at":"2026-11-09T17:27:40.000Z"},{"source":"x","kind":"post","url":"https://x.com/CloudCraftAi/status/2119842962175930652","author":"CloudCraftAi","author_name":"Cloud Craft AI","avatar_url":"https://pbs.twimg.com/profile_images/2109169201617510400/hIh7KdTQ_bigger.jpg","text":"🚨 SECURITY ALERT — PATCH NOW\n\nTwo actively exploited vulnerabilities demand attention:\n\n🔴 OpenSSH SSHole (CVE-2026-123158)\nAffects certain musl-based Linux systems, including Alpine. Update to OpenSSH 10.6p2 and restart SSH services.\n\n🔴 WordPress (CVE-2026-119977)\nAffects htt…","engagement":1,"posted_at":"2026-11-09T17:22:01.000Z"},{"source":"mastodon","kind":"post","url":"https://infosec.exchange/@cloud/117587593842685639","author":"cloud@infosec.exchange","author_name":"Cloud 🤖","avatar_url":"https://mastodon.social/avatars/original/missing.png","text":"🤖 Active exploitation of \"SSHole\" (CVE-2026-123158), a flaw in OpenSSH. Attackers use it to execute commands, steal credentials and keep persistent access on Linux hosts. Patch sshd and audit logs for unexpected sessions. 🔗 https://www. bleepingcomputer.com/news/secu rity/hack…","engagement":1,"posted_at":"2026-11-09T17:11:30.000Z"},{"source":"x","kind":"post","url":"https://x.com/bellsoftware/status/2119798270666911827","author":"bellsoftware","author_name":"BellSoft","avatar_url":"https://pbs.twimg.com/profile_images/1575208667804319757/yhHLM0Tx_bigger.jpg","text":"SSHole (CVE-2026-123158) can bypass OpenSSH password authentication on some musl-based Linux systems running without PAM.\n\nBellSoft shipped fixed packages for every supported Alpaquita branch within a day of disclosure. If you run sshd, update OpenSSH and restart the service.","engagement":1,"posted_at":"2026-11-09T14:24:26.000Z"},{"source":"mastodon","kind":"post","url":"https://infosec.exchange/@axnews/117585326678475646","author":"axnews@infosec.exchange","author_name":"AX-NEWS CVE watch","avatar_url":"https://files.mastodon.social/cache/accounts/avatars/117/517/993/482/474/488/original/755284c2a7907606.png","text":"🛡️ The CVEs that mattered · Sunday 8 November 1. CVE-2026-98432 · Critical 9.8 — Linux ≥ 2. CVE-2026-123158 · High 8.1 — OpenBSD OpenSSH https:// ax-news.com/cve # CVE # infosec","engagement":1,"posted_at":"2026-11-09T07:34:56.000Z"},{"source":"x","kind":"post","url":"https://x.com/Lost_Tanuki/status/2119640901639455168","author":"Lost_Tanuki","author_name":"彷徨狸【タヌキ横暴注意】","avatar_url":"https://pbs.twimg.com/profile_images/1767008561283166208/iWaRT67o_bigger.jpg","text":"CVE-2026-123158 に該当するのか調査開始して、はやくも『脆弱性が該当するか否かは機密事項に該当するので回答できません』と返してくるサービスベンダーが現れた。\n回答が下手だなぁ。『詳細はご回答できませんが、提供しているサービスにこの脆弱性の影響はありません』と答えりゃいいのに。","engagement":1,"posted_at":"2026-11-09T03:59:06.000Z"}],"exploit_repositories":[{"source":"github","kind":"poc","url":"https://github.com/gabrielunknown/CVE-2026-123158_SSHole","author":"gabrielunknown","author_name":null,"avatar_url":"https://avatars.githubusercontent.com/u/312725041?v=4","text":"gabrielunknown/CVE-2026-123158_SSHole: CVE-2026-123158 SSHole — OpenSSH authentication bypass via musl crypt() overflow on Alpine Linux (Exploit PoC)","engagement":4,"posted_at":"2026-11-05T22:51:12.000Z"},{"source":"github","kind":"poc","url":"https://github.com/Maalfer/CVE-2026-123158","author":"Maalfer","author_name":null,"avatar_url":"https://avatars.githubusercontent.com/u/96432001?v=4","text":"Maalfer/CVE-2026-123158: Exploit para explotar la vulnerabilidad CVE-2026-123158 (conocida como sshole).","engagement":4,"posted_at":"2026-11-06T08:01:34.000Z"},{"source":"github","kind":"poc","url":"https://github.com/0xBlackash/CVE-2026-123158","author":"0xBlackash","author_name":null,"avatar_url":"https://avatars.githubusercontent.com/u/259905299?v=4","text":"0xBlackash/CVE-2026-123158: CVE-2026-123158","engagement":1,"posted_at":"2026-11-05T20:13:50.000Z"},{"source":"github","kind":"poc","url":"https://github.com/rothoma2/cve-2026-123158-sshole","author":"rothoma2","author_name":null,"avatar_url":"https://avatars.githubusercontent.com/u/71269655?v=4","text":"rothoma2/cve-2026-123158-sshole: Scanner CVE-2026-123158 *SSHHole","engagement":1,"posted_at":"2026-11-05T21:32:16.000Z"},{"source":"github","kind":"poc","url":"https://github.com/HackSpeak/CVE-2026-123158","author":"HackSpeak","author_name":null,"avatar_url":"https://avatars.githubusercontent.com/u/312486542?v=4","text":"HackSpeak/CVE-2026-123158: OpenSSH + musl password authentication bypass (sshole) checker: local precondition audit + remote verification; for authorized testing","engagement":1,"posted_at":"2026-11-06T10:53:29.000Z"},{"source":"github","kind":"poc","url":"https://github.com/halilkirazkaya/CVE-2026-123158","author":"halilkirazkaya","author_name":null,"avatar_url":"https://avatars.githubusercontent.com/u/90972683?v=4","text":"halilkirazkaya/CVE-2026-123158: sshole (CVE-2026-123158): OpenSSH password bypass on alpine Linux","engagement":1,"posted_at":"2026-11-06T18:05:42.000Z"},{"source":"github","kind":"poc","url":"https://github.com/Galaxy-sc/CVE-2026-123158","author":"Galaxy-sc","author_name":null,"avatar_url":"https://avatars.githubusercontent.com/u/94435150?v=4","text":"Galaxy-sc/CVE-2026-123158","engagement":1,"posted_at":"2026-11-08T05:08:02.000Z"},{"source":"github","kind":"poc","url":"https://github.com/coboliqcom/cve-2026-123158-sshole-safe-rust","author":"coboliqcom","author_name":null,"avatar_url":"https://avatars.githubusercontent.com/u/202014810?v=4","text":"coboliqcom/cve-2026-123158-sshole-safe-rust","engagement":0,"posted_at":"2026-11-05T20:09:29.000Z"}]}}