CVE Details

CVE-2026-123158 OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability
Published: 2026-11-09 CVSS: 8.1 HIGH Product: OpenBSD OpenSSH Due Date: 2026-11-12

OpenBSD OpenSSH on Linux contains an unexpected status code or return value vulnerability that could allow for authentication bypass.

GitHub PoC

Warning: GitHub PoC repositories are unverified. Some may be fake or contain malware. Use caution and review code before running anything.
  • 0xMarcio/pocindex • ⭐ 1541 • 2024-05-24 • Conf: 85.0%
  • Search public CVE proof-of-concept exploits from GitHub, Nuclei, ExploitDB, Metasploit and Vulhub, with CVSS, EPSS and CISA KEV context.
  • waka-man/web_infra_lab • ⭐ 5 • 2025-07-07 • Conf: 95.0%

FIRST EPSS

EPSS estimates the probability of exploitation in the next 30 days. Higher values indicate higher likelihood of real-world exploitation.

Timeline

CVE Stalker KEV MITRE GitHub FIRST (EPSS)

MITRE

CVSS

  • Score: 8.1
  • Severity: HIGH
  • Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

  • Exploitation: active
  • Automatable: no
  • Technical Impact: total

References

Show Raw Data
Key Remaining Key Value
dataType CVE_RECORD
dataVersion 5.2
cveMetadata > cveId CVE-2026-123158
cveMetadata > assignerOrgId 8254265b-2729-46b6-b9e3-3dfca2d5bfca
cveMetadata > state PUBLISHED
cveMetadata > assignerShortName mitre
cveMetadata > dateReserved 2026-11-05T15:46:25.881Z
cveMetadata > datePublished 2026-11-05T15:46:26.488Z
cveMetadata > dateUpdated 2026-11-09T16:54:01.606Z
containers > cna > affected > 0 > defaultStatus unaffected
containers > cna > affected > 0 > platforms > 0 Linux
containers > cna > affected > 0 > product OpenSSH
containers > cna > affected > 0 > vendor OpenBSD
containers > cna > affected > 0 > versions > 0 > lessThan 10.6p2
containers > cna > affected > 0 > versions > 0 > status affected
containers > cna > affected > 0 > versions > 0 > version 0
containers > cna > affected > 0 > versions > 0 > versionType custom
containers > cna > descriptions > 0 > lang en
containers > cna > descriptions > 0 > value sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
containers > cna > metrics > 0 > cvssV3_1 > attackComplexity HIGH
containers > cna > metrics > 0 > cvssV3_1 > attackVector NETWORK
containers > cna > metrics > 0 > cvssV3_1 > availabilityImpact HIGH
containers > cna > metrics > 0 > cvssV3_1 > baseScore 8.1
containers > cna > metrics > 0 > cvssV3_1 > baseSeverity HIGH
containers > cna > metrics > 0 > cvssV3_1 > confidentialityImpact HIGH
containers > cna > metrics > 0 > cvssV3_1 > integrityImpact HIGH
containers > cna > metrics > 0 > cvssV3_1 > privilegesRequired NONE
containers > cna > metrics > 0 > cvssV3_1 > scope UNCHANGED
containers > cna > metrics > 0 > cvssV3_1 > userInteraction NONE
containers > cna > metrics > 0 > cvssV3_1 > vectorString CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
containers > cna > metrics > 0 > cvssV3_1 > version 3.1
containers > cna > metrics > 0 > format CVSS
containers > cna > metrics > 0 > scenarios > 0 > lang en
containers > cna > metrics > 0 > scenarios > 0 > value GENERAL
containers > cna > problemTypes > 0 > descriptions > 0 > cweId CWE-394
containers > cna > problemTypes > 0 > descriptions > 0 > description CWE-394 Unexpected Status Code or Return Value
containers > cna > problemTypes > 0 > descriptions > 0 > lang en
containers > cna > problemTypes > 0 > descriptions > 0 > type CWE
containers > cna > providerMetadata > orgId 8254265b-2729-46b6-b9e3-3dfca2d5bfca
containers > cna > providerMetadata > shortName mitre
containers > cna > providerMetadata > dateUpdated 2026-11-05T15:46:26.488Z
containers > cna > references > 0 > url https://www.openssh.org/releasenotes.html#10.6p2
containers > cna > references > 1 > url https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482
containers > cna > references > 2 > url https://news.ycombinator.com/item?id=50377976
containers > cna > references > 3 > url https://news.ycombinator.com/item?id=50378228
containers > cna > references > 4 > url https://marc.info/?l=openssh-unix-dev&m=179388064263131&w=2
containers > cna > references > 5 > url https://hachyderm.io/@damienmiller/117563026759098135
containers > cna > references > 6 > url https://github.com/predkambrij/sshhole-repro
containers > cna > references > 7 > url https://github.com/leonjza/sshhole-lab
containers > cna > x_generator > engine CVE-Request-form 0.0.1
containers > cna > cpeApplicability > 0 > nodes > 0 > operator OR
containers > cna > cpeApplicability > 0 > nodes > 0 > negate False
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 0 > vulnerable True
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 0 > criteria cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 0 > versionEndExcluding 10.6p2
containers > adp > 0 > providerMetadata > orgId af854a3a-2127-422b-91ae-364da2661108
containers > adp > 0 > providerMetadata > shortName CVE
containers > adp > 0 > providerMetadata > dateUpdated 2026-11-08T02:55:48.643Z
containers > adp > 0 > references > 0 > url https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/
containers > adp > 0 > references > 1 > url https://news.ycombinator.com/item?id=50379704
containers > adp > 0 > references > 2 > url https://github.com/google/goonami-scanner/pull/277
containers > adp > 0 > references > 3 > url https://github.com/coollabsio/coolify/discussions/12484
containers > adp > 0 > references > 4 > url https://github.com/panubo/docker-sshd/issues/93
containers > adp > 0 > title CVE Program Container
containers > adp > 0 > x_generator > engine ADPogram 0.0.1
containers > adp > 1 > metrics > 0 > other > type ssvc
containers > adp > 1 > metrics > 0 > other > content > id CVE-2026-123158
containers > adp > 1 > metrics > 0 > other > content > role CISA Coordinator
containers > adp > 1 > metrics > 0 > other > content > options > 0 > Exploitation active
containers > adp > 1 > metrics > 0 > other > content > options > 1 > Automatable no
containers > adp > 1 > metrics > 0 > other > content > options > 2 > Technical Impact total
containers > adp > 1 > metrics > 0 > other > content > version 2.0.3
containers > adp > 1 > metrics > 0 > other > content > timestamp 2026-11-09T16:50:17.920404Z
containers > adp > 1 > references > 0 > url https://sshhole.com
containers > adp > 1 > references > 0 > tags > 0 exploit
containers > adp > 1 > references > 0 > tags > 1 technical-description
containers > adp > 1 > references > 1 > url https://sshole.events.greynoise.io/
containers > adp > 1 > references > 1 > tags > 0 third-party-advisory
containers > adp > 1 > references > 2 > url https://isc.sans.edu/diary.html?storyid=33498
containers > adp > 1 > references > 2 > tags > 0 third-party-advisory
containers > adp > 1 > references > 3 > url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-123158
containers > adp > 1 > references > 3 > tags > 0 government-resource
containers > adp > 1 > title CISA ADP Vulnrichment
containers > adp > 1 > providerMetadata > orgId 134c704f-9b21-4f2e-91b3-4a467353bcc0
containers > adp > 1 > providerMetadata > shortName CISA-ADP
containers > adp > 1 > providerMetadata > dateUpdated 2026-11-09T16:54:01.606Z