Short answer: A flaw in OpenSSH lets attackers log into password-disabled accounts on Linux systems using musl C library. Users should update to OpenSSH 10.6p2 and restart sshd.
TL;DR
- OpenSSH 10.6p2 fixes a critical vulnerability.
- Linux distributions like Alpine with musl C library are affected.
- Accounts with password disabled can be accessed.
- Update and restart sshd to protect systems.
What is CVE-2026-123158?
This issue is a security flaw in OpenSSH that allows attackers to log in to password-disabled accounts on Linux systems using the musl C library. It can be exploited by sending an oversized password. The vulnerability has been fixed in OpenSSH 10.6p2, but users need to update and restart the sshd service to protect their systems.
- Vulnerability
- A mistake or weakness in software that an attacker can misuse.
- Exploit
- Code or steps that take advantage of a weakness.
Key facts
| Reported by | CSO Online |
|---|---|
| Date reported | 06 Nov 2026 |
| CVE | CVE-2026-123158 |
| CVSS | 8.1 HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Weakness | CWE-394 (see NVD) |
| CISA KEV | Not listed (no confirmed exploitation in KEV) |
| CVE | CVE-2016-6210 |
| CVSS | 5.9 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
| Weakness | CWE-200 (see NVD) |
| CISA KEV | Not listed (no confirmed exploitation in KEV) |
| Vendor advisory | www.openssh.com |
| Affected product | OpenSSH |
| Fixed versions | 10.6p2 (CVE-2026-123158, per NVD) |
| Fixed versions | 7.3 (CVE-2016-6210, per NVD) |
| Published in NVD | 2026-11-05 (CVE-2026-123158) |
| Published in NVD | 2017-02-13 (CVE-2016-6210) |
How it works
This flaw affects OpenSSH on Linux systems using the musl C library, not glibc. Attackers can send a long password (257-1,024 bytes) to log into accounts that should have password authentication disabled. The flaw dates back to 2012 and 2016 changes in OpenSSH and musl.
- Attacker reaches the OpenSSH over the internet / network
- No login or account is needed
- Sends crafted input that triggers the flaw
- Impact: data can be read, data or code can be changed, service crashes or stops
Skillmate analyst mapping (our judgement, not from the vendor):
- T1190 Exploit Public-Facing Application
Timeline
| Date | Event | Source |
|---|---|---|
| 2017-02-13 | CVE-2016-6210 published in NVD | NVD |
| 2026-11-05 | CVE-2026-123158 published in NVD | NVD |
| 2026-11-06 | Reported by CSO Online | CSO Online |
| 2026-11-07 | This Skillmate explainer published | Skillmate |
Am I affected?
These commands only read the version or settings. Compare the output with the vendor advisory linked in the facts table.
OpenSSH
shows the installed OpenSSH client version:
ssh -VHow to fix it
- Update OpenSSH now. NVD lists the fixed versions as 10.6p2; 7.3.
- Read the vendor advisory for CVE-2016-6210 and upgrade to the fixed release it lists.
- If you cannot patch today, limit who can reach the affected service and watch its logs.
How to detect it
Defenders should look for log entries like 'Accepted password for' involving accounts that should not accept password logins.
What is confirmed and what is not
| Confirmed | Not confirmed yet |
|---|---|
| CVE-2026-123158 is a real NVD record scored 8.1 HIGH | CISA KEV does not list CVE-2026-123158 as exploited in the wild |
| CVE-2016-6210 is a real NVD record scored 5.9 MEDIUM | NVD links no vendor advisory for CVE-2026-123158 yet |
| NVD lists fixed versions for CVE-2026-123158: 10.6p2 | CISA KEV does not list CVE-2016-6210 as exploited in the wild |
| NVD lists fixed versions for CVE-2016-6210: 7.3 | |
| Reported by CSO Online | |
| Reported by The Hacker News | |
| Reported by Help Net Security | |
| Reported by www.openssh.com |
Why it matters
This flaw matters because attackers can gain unauthorized access to systems with password-disabled accounts, leading to potential data breaches. Alpine Linux, widely used in cloud environments, is particularly vulnerable.
Learn the skills behind this story
Want to understand attacks like this and defend against them? Join Skillmate cybersecurity training or practise hands-on in Skillmate Labs.
FAQ
Is this vulnerability affecting many systems?
The flaw is confined to Linux systems using musl C library and OpenSSH, not all systems are affected.
How can attackers exploit this vulnerability?
Attackers can send a long password (between 257 and 1,024 characters) to access accounts that should have password authentication disabled.
What steps should I take to protect my system?
Update to OpenSSH 10.6p2 and restart sshd. Disable password-based authentication and use key-based authentication if possible.
What are the risks if the vulnerability is exploited?
Attackers can gain access to the system with the compromised account's permissions, potentially leading to root access.
Sources
- OpenSSH flaw lets attackers access password-disabled accounts on some Linux systems (CSO Online)
- Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot (The Hacker News)
- OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158) (Help Net Security)
- Vendor advisory CVE-2016-6210 (www.openssh.com)
- NVD CVE record (NVD)
How we wrote this: facts come from the sources above, NVD and CISA KEV. An on-prem AI model drafted the plain-English parts and every sentence was checked against the sources; unsupported sentences were removed. MITRE mapping is our own judgement.
