CISAAnalysisCISA adds OpenBSD OpenSSH SSHole authentication bypass flaw to KEV catalog
What happened.CISA added the high-severity OpenSSH SSHole authentication bypass vulnerability to its Known Exploited Vulnerabilities catalog following observed attacks against Linux systems.
Why it matters.Secure Shell daemons represent the standard administrative access pathway into production Linux servers and container environments. When authentication logic errors allow attackers to log into accounts without valid credentials, automated botnets compromise cloud instances rapidly. Infrastructure engineers running lightweight container images based on musl libc must upgrade OpenSSH packages immediately and restart SSH daemons.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-123158 with an 8.1 CVSS score, the defect involves an authentication bypass in OpenSSH daemon implementations.
- Root cause: Systems running OpenSSH on musl libc without PAM incorrectly authenticate overlong passwords against accounts configured without active passwords.
- Exploitation impact: Remote unauthenticated attackers send crafted password strings between 256 and 1024 bytes to gain shell access to target user accounts.
- Remediation release: OpenSSH maintainers published version 10.6p2, and Linux distributions including Alpine issued updated security packages.