Advisory 2026-4277 - OpenSSH: Vulnerability allows gaining administrative rights

Notice: You can now also find information from the Vulnerability Advisory Service in the CTI portal!
The CTI portal is available at the following address: https://cti-portal.telekom.net/advisories/2026-4277

Notice: This advisory is by exception shown completely public. You will regularly receive details on vulnerability information as a customer via your login or through our daily advisory e-mail.

5	Attack probability high
5	Potential damage high

Date: 2026-11-06
Release: 2026-11-06

Operating System

Linux

Software

Open Source Alpine Linux
Open Source OpenSSH < 10.6p2

Attack

A remote anonymous attacker can exploit a vulnerability in OpenSSH (combined with musl libc and without PAM) in order to gain administrative rights.

Description

OpenSSH is an open-source implementation of the Secure Shell Protocol. Alpine Linux is a small Linux distribution based on BusyBox.

CVE-2026-123158

In OpenSSH, a vulnerability exists in password authentication when it is run with musl libc and disabled PAM support. An error value from the password hash check is not handled correctly. A remote, anonymous attacker can bypass password authentication using a very long password input and log in to certain account configurations without knowledge of the correct password. Even accounts that are actually locked, including root, can be affected.

CVSSv2 Base Score: 7.6 / Temporal Score: 6.0
AV:N/AC:H/AU:N/C:C/I:C/A:C/E:POC/RL:OF/RC:ND
CVSSv3.1 Base Score: 8.1 / Temporal Score: 7.3
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:X

Exploitation is trivial and docuemnted publicly.

Recommendation

The developers provide updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://www.openssh.org/releasenotes.html#10.6p2

Alpine Linux provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://www.alpinelinux.org/posts/alpine-3.21.10-3.22.8-3.23.8-3.24.4-released/

Information

OpenSSH Release Notes dated 2026-11-05
https://www.openssh.org/releasenotes.html#10.6p2

Administrator.de dated 2026-11-05
https://administrator.de/info/openssh-sicherheitsluecke-ssh-zugriff-musl-libc-679405.html

SSHole Website dated 2026-11-05
https://sshhole.com/

Heise Online dated 2026-11-05
https://www.heise.de/news/OpenSSH-und-Alpine-Linux-warnt-vor-nischigem-aber-gravierendem-Bug-11513105.html

Alpine Linux Advisory
https://www.alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/

References

CVE:CVE-2026-123158
EUVD:EUVD-2026-117552
VULNAME:SSHOLE

Disclaimer

*The probability of an attack is determined by the attacker's motivation, the necessary expend and the possibilities for an attack. The damage probability is determined by the expend needed to resolute the attack and probable indirect consequences of an attack for business processes. Telekom Security assumes worst case scenarios.

Copyright © 1999-2026 Deutsche Telekom Security GmbH. All rights reserved. Reproduction and distribution of this publication in any form - even in parts - without prior written permission is forbidden.

The information contained herein has been obtained from sources believed to be reliable and trusted or have been verified. Telekom Security can take liability for completeness, accuracy and correctness only in so far, as gross negligence or intention create liability. Any liability beyond it, in particular possible damages resulting from using or non-usability of the information contained herein, is excluded.