CVE-2026-123158 is a critical authentication bypass vulnerability in OpenSSH on Linux systems built with the musl C library instead of glibc, including Alpine Linux official cloud images published between versions 3.18.11 and 3.24.3 and embedded distributions. The flaw affects the OpenSSH password authentication component when the server is configured without Pluggable Authentication Modules, allows password-based authentication, and a target account has password login disabled at the system level. A remote attacker who knows an account name can send an over-long password, specifically between 257 and 1,024 characters, to that account. On affected musl systems, the password hashing function fails for the excessive length and returns an asterisk, which matches the asterisk stored for a password-disabled account, causing the server to accept the login. The attack requires no special exploit engineering beyond adding a long password to ordinary brute-force attempts, but it also requires that at least one legitimate account with a real password exists. Business impact is severe because affected Alpine cloud images expose the default alpine account with passwordless doas privileges, allowing an attacker to switch to root, execute commands, access sensitive data, move laterally, and compromise containers or embedded systems.
The following reports contain further technical details:[/subscribe_to_unlock_form]
CVE-2026-123158 is a critical authentication bypass vulnerability in OpenSSH on Linux systems built with the musl C library instead of glibc, including Alpine Linux official cloud images published between versions 3.18.11 and 3.24.3 and embedded distributions. The flaw affects the OpenSSH password authentication component when the server is configured without Pluggable Authentication Modules, allows password-based authentication, and a target account has password login disabled at the system level. A remote attacker who knows an account name can send an over-long password, specifically between 257 and 1,024 characters, to that account. On affected musl systems, the password hashing function fails for the excessive length and returns an asterisk, which matches the asterisk stored for a password-disabled account, causing the server to accept the login. The attack requires no special exploit engineering beyond adding a long password to ordinary brute-force attempts, but it also requires that at least one legitimate account with a real password exists. Business impact is severe because affected Alpine cloud images expose the default alpine account with passwordless doas privileges, allowing an attacker to switch to root, execute commands, access sensitive data, move laterally, and compromise containers or embedded systems.
The following reports contain further technical details:[emaillocker id="1283"]
[/emaillocker]