Vendors and CVEs › CVEs › CVE-2026-123158
CVE-2026-123158: what it is, who is affected and what to do
A flaw in the OpenSSH server (sshd) before 10.6p2 lets some accounts be opened with any password of 256 to 1024 characters. It applies on Linux using musl libc without PAM, such as Alpine Linux.
- Known exploited. Yes, on CISA’s list of exploited flaws.
- CVSS. 8.1, as the source states.
- Records. CVE-2026-123158 on the National Vulnerability Database · CISA’s known exploited catalog
The story
Critical Known exploited
Moxa responds to OpenSSH password bypass on Linux without PAM
A flaw in the OpenSSH server (sshd) before 10.6p2 lets some accounts be opened with any password of 256 to 1024 characters. It applies on Linux using musl libc without PAM, such as Alpine Linux.