OpenSSH 10.6p2: authentication bypass flaw exploited in the wild

What it is and who is affectedCVE-2026-123158 is a vulnerability in OpenBSD OpenSSH officially described as an "Unexpected Status Code or Return Value...

What it is and who is affected

CVE-2026-123158 is a vulnerability in OpenBSD OpenSSH officially described as an "Unexpected Status Code or Return Value Vulnerability". In practice, it allows an attacker to skip password authentication altogether. The NVD entry is more specific: sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass, linked to a misinterpretation of whether a string is meant to be a password hash. For some account configurations, any password between 256 and 1024 characters succeeds. Alpine Linux is cited as an example of a platform that uses musl libc without PAM.

The affected versions listed by NVD are OpenBSD OpenSSH up to 10.6 (exclusive), plus 10.6 and 10.6 p1. The flaw is classified as CWE-394 and carries a CVSS 3.1 score of 8.1 (HIGH), with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. It was published in the NVD on 5 November 2026.

For a small company in Spain, the practical question is narrow but important: do you run Linux servers with OpenSSH, and does any of them use musl libc without PAM? Container images, lightweight distributions and some cloud appliances are the usual suspects. If your web stack sits on a standard Debian or Ubuntu host with PAM in place, exposure is lower, but the version check still matters.

Why it is urgent

This is not a theoretical flaw waiting for a proof of concept. CISA added CVE-2026-123158 to its Known Exploited Vulnerabilities (KEV) catalogue on 9 November 2026, which means it has been observed in real attacks. CISA gave US federal agencies until 12 November 2026 to apply the vendor's mitigations, following its BOD 26-04 guidance on prioritising security updates by risk, and to meet its forensics triage requirements. Where mitigations are unavailable for cloud services, the guidance is to discontinue use of the product.

Two details deserve attention. First, the required action is to apply mitigations in accordance with vendor instructions, not simply to wait for a convenient maintenance window. Second, CISA asks asset owners to evaluate each system's internet exposure. An SSH service reachable from the public internet is exactly the kind of asset that turns a HIGH-severity bug into a real incident. The material does not record known use in ransomware campaigns, so treat that as unknown rather than as reassurance.

What to do today

Inventory your SSH. List every Linux host, container image and appliance running sshd, and record the OpenSSH version. Anything below 10.6p2 is in scope; 10.6 and 10.6 p1 are explicitly listed.
Check the libc and PAM combination. The bypass applies when musl libc is used without PAM. Confirm what your images actually ship, rather than assuming.
Update as the vendor advisory states. The OpenSSH project published the fix in its development mailing list and in the portable repository commit referenced by NVD. Apply whatever version and steps that advisory specifies; do not guess a target version.
Look for signs of intrusion. Review authentication logs for successful logins that should not have happened, unusually long password strings, and sessions from unexpected addresses. Rotate credentials and keys on any host you cannot fully account for.
Reduce what is exposed. Restrict SSH to VPN, bastion hosts or allowlisted addresses, disable password authentication in favour of keys where possible, and remove unused accounts.

None of this requires a large team, but it does require someone to actually check. A version you have not verified is a version you cannot defend.

How a cybersecurity team like ALMC's can help

For SMEs, online shops and companies with a small IT department, the hard part is rarely reading the advisory; it is knowing where OpenSSH runs across servers, containers and legacy systems, and then closing the gap without breaking production. At ALMC we work on exactly that: security audits and pentesting to find vulnerabilities before they are exploited, server hardening, monitoring and incident response, and the maintenance and updating of the platforms our clients depend on, including WordPress, PrestaShop and Joomla. When a site has already been compromised, we also handle the cleanup and recovery.

If your infrastructure includes Linux hosts with SSH exposed, or you simply are not sure which OpenSSH versions you are running, a short review of your estate is a sensible next step. The vulnerability is public, it is in CISA's KEV catalogue, and the window between disclosure and exploitation has already closed.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.