Security
1 min read0 views
CVE-2026-123158: sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass… (Update: added to CISA KEV)
Update: added to CISA KEV. OpenSSH's sshd on Linux systems that use musl libc without PAM (such as Alpine Linux) lets an attacker bypass password authentication remotely, without logging in, by sending any password between 256 and 1024 characters for some account configurations. This only affects a non-default setup with PAM support disabled, but public exploit code exists and the…
Reading Level🟢Beginner
Listen to this article
Update: added to CISA KEV. OpenSSH's sshd on Linux systems that use musl libc without PAM (such as Alpine Linux) lets an attacker bypass password authentication remotely, without logging in, by sending any password between 256 and 1024 characters for some account configurations. This only affects a non-default setup with PAM support disabled, but public exploit code exists and the bug is listed as being exploited in atta...
Original Source
cve.now CISA KEVLike this article
Share this article
Share:
Related Articles
CVE-2026-125350: Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a… (Update: added to CISA KEV)
1 min read·1h ago
CVE-2026-111560: OS Command Injection in Barracuda Appliances (Update: added to CISA KEV)
1 min read·1h ago
CVE-2026-116606: Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway (Update: added to CISA KEV)
1 min read·1h ago