No VulnCrest analysis published for this CVE yet. Below is the original CNA/NVD description, unmodified.
Description
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
Exploits & detection
Exploitgabrielunknown/CVE-2026-123158_SSHole · github · ★ 8 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
ExploitMaalfer/CVE-2026-123158 · github · ★ 4 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
ExploitGalaxy-sc/CVE-2026-123158 · github · ★ 1 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
Exploitashrafzaryouh/CVE-2026-123158 · github · ★ 1 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
Exploitcoboliqcom/cve-2026-123158-sshole-safe-rust · github · ★ 1 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
Exploitcrash00xd/CVE-2026-123158_SSHRole_PoC · github · ★ 1 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
Exploitrothoma2/cve-2026-123158-sshole · github · ★ 1 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
ExploitCriticalWombat/sshole_scanner-CVE-2026-123158 · github · ★ 0 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
ExploitD1se0/CVE-2026-123158 · github · ★ 0 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
ExploitFuncan/sshole · github · ★ 0 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
ExploitHel1um17/sshole-bypass-openssh-password · github · ★ 0 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
ExploitMikeCase/check-sshole · github · ★ 0 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
Exploitaciddust/CVE-2026-123158-LAB · github · ★ 0 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
Exploitakarkode/alpine-openssh-sshole-auth-bypass · github · ★ 0 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
Exploitansonhsu-ai/sshhole-cve-2026-123158-ste · github · ★ 0 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
Exploitliamromanis101/MaSSHole · github · ★ 0 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
Exploitlpizziniacofortinet/cve-2026-123158-openssh-musl-lab · github · ★ 0 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
Exploitmc493/openssh-musl-enterprise--hardening-cve-2026-123158 · github · ★ 0 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
Exploitmlazzarotto/ansible-sshole-remediate · github · ★ 0 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
Exploitpablocerdeira1/CVE-2026-123158 · github · ★ 0 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
Exploitshenxianpeng/check-sshole · github · ★ 0 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
Exploittechdevfun/alpinegate · github · ★ 0 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
Exploittechtaek77/sshole-guide · github · ★ 0 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
Exploithttps://github.com/leonjza/sshhole-lab · nvd · discovered
Exploithttps://github.com/predkambrij/sshhole-repro · nvd · discovered
5 repository link(s) hidden as suspicious (binaries, password-protected archives or lure wording).
In the news
- Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on HoneypotThe Hacker News · 06 Nov 2026
Timeline
- Published: 05 Nov 2026
- Last modified upstream: 10 Nov 2026
- Added to CISA KEV: 09 Nov 2026
Sources & licenses
- CVE / CVSS / CWE
- NVD record ↗ (unmodified). This product uses the NVD API but is not endorsed or certified by the NVD. CVE® © The MITRE Corporation.
- Exploitation
- CISA KEV (CC0) · EPSS by FIRST.org
- References used for the analysis
- https://github.com/leonjza/sshhole-lab (Exploit, Third Party Advisory)
- https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482 (Patch)
- https://github.com/predkambrij/sshhole-repro (Exploit, Third Party Advisory)
- https://hachyderm.io/@damienmiller/117563026759098135 (Third Party Advisory)
- https://marc.info/?l=openssh-unix-dev&m=179388064263131&w=2 (Mailing List, Vendor Advisory)
- https://news.ycombinator.com/item?id=50377976 (Issue Tracking)
- https://news.ycombinator.com/item?id=50378228 (Issue Tracking)
- https://www.openssh.org/releasenotes.html#10.6p2 (Release Notes)
- http://www.openwall.com/lists/oss-security/2026/11/09/27 (Mailing List)
- https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/ (Third Party Advisory)
- https://github.com/coollabsio/coolify/discussions/12484 (Third Party Advisory)
- https://github.com/google/goonami-scanner/pull/277 (Third Party Advisory)
- Analysis, summary and remediation
- © VulnCrest