# CVE-2026-123158: OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability

- Exploited (CISA KEV): yes, added 2026-11-09
- Published: 2026-11-05
- CVSS: 8.1 HIGH (v3.1)
- EPSS: 1.0% (63th percentile)
- CWE: CWE-394

sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | No public claim | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | No public claim | — | — |
| Vercel | No public claim | — | — |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

## Social

542 posts seen since 2026-11-05.

- Exploit repository (unvetted): https://github.com/gabrielunknown/CVE-2026-123158_SSHole
- Exploit repository (unvetted): https://github.com/Maalfer/CVE-2026-123158
- Exploit repository (unvetted): https://github.com/0xBlackash/CVE-2026-123158
- Exploit repository (unvetted): https://github.com/rothoma2/cve-2026-123158-sshole
- Exploit repository (unvetted): https://github.com/HackSpeak/CVE-2026-123158
- Exploit repository (unvetted): https://github.com/halilkirazkaya/CVE-2026-123158
- Exploit repository (unvetted): https://github.com/Galaxy-sc/CVE-2026-123158
- Exploit repository (unvetted): https://github.com/coboliqcom/cve-2026-123158-sshole-safe-rust
- x 2026-11-08: SSHole (CVE-2026-123158): pre-auth SSH bypass on OpenSSH/musl, no PAM.  With credential auth enabled, a "*" shadow entry and another "$5$"/"$6$" hash, a 257–1024-byte input makes "crypt()" return "*"—accepted as a match.  Fix: 10.6p2 / backports.  Nuclei PR: (https://x.com/AlAssaf_H/status/2119328462527758526)
- x 2026-11-08: برادر در حال نفوذ به قلب دختر مردم، با آسیب‌پذیری اخیر  CVE-2026-123158 🫡 https://t.co/6R87txLz3m (https://x.com/Habeangorishere/status/2119370733898121497)
- x 2026-11-06: GreyNoise is monitoring scanning, exploitation attempts, and successful exploitation of SSHole, an OpenSSH flaw affecting musl-based Linux systems like Alpine. CVE-2026-123158 (CVSS 8.1) is trivial to exploit and working exploits are publicly available.  See what we’re observing… (https://x.com/GreyNoiseIO/status/2118820867493056753)
- x 2026-11-06: En las últimas horas se está hablando bastante de CVE-2026-123158, un bypass de autenticación que afecta a determinadas configuraciones de OpenSSH sobre musl Linux.  Desde SixHack Academy hemos preparado un análisis técnico completo 👇  https://t.co/g9Nr6kl7bf  #OpenSSH  #CVE (https://x.com/SixHackAcademy/status/2118668110735765558)
- mastodon 2026-11-09: Placeholder for future CISA blog post: https://www. cisa.gov/news-events/alerts/20 26/11/09/cisa-adds-three-known-exploited-vulnerabilities-catalog KEV Catalog already shows 3 new CVEs: CVE-2026-116779 SignalWire FreeSwitch Code Injection Vulnerability CVE-2026-123158 (aka sshho… (https://infosec.exchange/@ssvc/117587842105930939)

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2026-123158 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2026-123158