The vulnerability CVE-2026-123158 exposes Linux servers that use musl libc and have PAM disabled to a concrete risk: it allows a remote attacker to gain SSH access without knowing the password, bypassing password authentication under specific conditions. The issue has been corrected by OpenSSH in version 10.6p2. For technical teams responsible for Linux infrastructure, updating and reviewing authentication configurations are urgent measures to contain the risk.
CVE-2026-123158: understanding the flaw
The error occurs in Linux systems that combine the musl libc library — common in lightweight distributions like Alpine Linux — and disabled PAM (Pluggable Authentication Modules). In these cases, the sshd may incorrectly interpret very long passwords (between 257 and 1024 bytes), allowing unauthorized access even when the provided password is invalid. The flaw manifests when there is a local account with a password field '*' (common in accounts configured only for key login) and at least one other account with a hash password of type $5$ or $6$.
Distributions like Alpine Linux are especially susceptible, as they typically compile OpenSSH without support for PAM. Systems like Red Hat Enterprise Linux, which use glibc and keep PAM active, are not affected. The impact is high in production environments, cloud or internet-facing servers, especially where password authentication remains active and local accounts have not been reviewed.
The attack can be performed remotely, without user interaction or prior knowledge of the password. This increases the attack surface and requires heightened vigilance in multi-user or automated environments.
Technical details: how exploitation occurs
To exploit CVE-2026-123158, the attacker relies on a sequence of conditions:
- OpenSSH running on a Linux system with musl libc and PAM disabled.
- Password authentication enabled in the sshd_config file.
- Presence of a local account whose password field in /etc/shadow is '*'.
- Existence of at least one account with a $5$ (SHA-256) or $6$ (SHA-512) password hash.
The attacker carries out the attack by sending an especially long password during the SSH login attempt. The vulnerable sshd does not correctly validate the size of the password hash, allowing access even without the correct password. The error lies in the handling of password and hash strings, exacerbated by the absence of PAM as an authentication layer.
To identify possible exploits, it is advisable to monitor authentication logs, look for login attempts with unusually sized passwords, and analyze atypical access patterns. Tools like auditd and Linux kernel auditing can be employed to track suspicious actions, especially in accounts restricted to key authentication.
Risk scenarios: in-depth analysis
- Alpine Linux servers in cloud and containers: Environments using Alpine Linux, common in containers and cloud solutions due to their lightness, are exposed if password authentication is not explicitly disabled. Even accounts intended for key login, if they maintain a password field '*', become attack vectors if there are other accounts with $5$ or $6$ hashes.
- Multi-user infrastructure: In servers with multiple local users, there is a greater likelihood that configurations allowing exploitation coexist. The absence of regular auditing over users and passwords may leave unidentified gaps. An example is a DevOps team with old accounts that have not been reviewed.
- Automation and CI/CD pipelines: Container images or VMs based on vulnerable versions of OpenSSH can spread the risk throughout the automation cycle, especially if updates are not automated. A pipeline that generates multiple instances from an outdated Alpine Linux image propagates the vulnerability on a large scale.
- Environments with glibc and PAM: Systems like Red Hat Enterprise Linux, which use glibc and keep PAM enabled by default, are not affected. This contrast reinforces the importance of understanding not only the software but also the libraries and compilation options involved in the chosen distribution.
The access gained through this flaw can result in remote shell access, malware installation, persistence, and privilege escalation. Environments without strict access policies or confinement through SELinux are even more vulnerable to extensive damage.
Mitigation: practical guidance
To protect vulnerable servers, follow these technical recommendations aligned with the guidelines from distributions and OpenSSH:
- 1. Update to OpenSSH 10.6p2: Install the patched version as soon as possible. On Alpine Linux, use:
apk update && apk add --upgrade openssh
After updating, restart sshd:
rc-service sshd restart or service sshd restart - 2. Disable password authentication if you cannot update immediately: In sshd_config, set PasswordAuthentication no and restart the service.
sed -i 's/^#\?PasswordAuthentication .*/PasswordAuthentication no/' /etc/ssh/sshd_config - 3. Prefer SSH key or multi-factor authentication: Ensure that all access is done through cryptographic keys and, if possible, adopt multi-factor authentication to reduce the attack surface.
- 4. Audit users and password fields: Review /etc/shadow to identify accounts with a password field '*', using, for example:
awk -F: '$2 == "*" {print $1}' /etc/shadow
Remove unnecessary accounts and adjust configurations according to actual usage. - 5. Monitor and audit access: Enable detailed logs and use tools like auditd to identify suspicious attempts. Adjust /etc/audit/audit.rules to record relevant events.
- 6. Implement confinement with SELinux: Keep SELinux in enforcing mode and map accounts to restricted domains. This limits the reach of attackers in case of exploitation.
- 7. Update container images and automated pipelines: Ensure that all base images are patched before new deployments. Automate the verification of OpenSSH versions in CI/CD pipelines to avoid recurrences.
Reinforce the practice of continuous updates and review of authentication configurations in all Linux environments under your management.
Recurring mistakes and how to avoid them
- Procrastinating updates: Delaying the update of OpenSSH keeps the environment vulnerable. Firewalls or network restrictions do not replace fixing the flaw, as the attack can come from internal users or already compromised networks.
- Unnecessarily keeping PasswordAuthentication enabled: Even if the main access is via keys, leaving PasswordAuthentication yes active exposes local accounts. Always disable it whenever possible.
- Forgetting to restart sshd: After updating or changing configurations, restart the service to ensure that changes take effect:
systemctl restart sshd or service sshd restart - Not reviewing local accounts and password fields: Old or unused accounts can be exploited. Use commands like awk -F: '$2 == "*" {print $1}' /etc/shadow periodically to identify risk cases.
- Ignoring automated environments: Containers and pipelines can perpetuate the vulnerability if base images are not updated. Always check and test images before deploying to production.
- Relaxing SELinux policies without reason: Keeping SELinux in permissive mode expands the impact of an intrusion. Use enforcing mode whenever possible to limit the actions of attackers.
Avoiding these mistakes strengthens the security posture of the infrastructure and significantly reduces exposure to risk.
Frequently asked questions
Which systems are affected by CVE-2026-123158?
Linux servers that use musl libc and have PAM disabled, such as Alpine Linux, are vulnerable. Systems based on glibc with PAM active (for example, Red Hat Enterprise Linux) are not affected.
What to do if it is not possible to update immediately?
Disable password authentication in sshd_config, restart the sshd service, and ensure that all access is made exclusively via SSH keys. Monitor logs and periodically review users and settings until the update is feasible.
How to identify if the environment is vulnerable?
Check if the system uses musl libc, if PAM is disabled, and if OpenSSH is prior to version 10.6p2. Analyze /etc/shadow for accounts with a password field '*', and if there is at least one account with a $5$ or $6$ hash.
Are distributions like Ubuntu affected?
Red Hat Enterprise Linux is not affected. The available information does not detail the case for Ubuntu, but the vulnerability is restricted to Linux systems that use musl libc and have PAM disabled.
Conclusion
To mitigate CVE-2026-123158, keep OpenSSH updated, disable password authentication when possible, and use key authentication. Review local accounts and automate updates in production environments. To expand your knowledge in infrastructure and DevOps security, visit the Hcode course platform.
Sources
OpenSSH 10.6p2, OpenSSH, November 5, 2026.
Security advisory: openssh-server password authentication bypass, Alpine Linux, November 5, 2026.
CVE-2026-123158, Red Hat Customer Portal, November 5, 2026.