CVE-2026-123158highexplotación observadaCWE-394

CVE-2026-123158: fallo de gravedad alta en OpenBSD OpenSSH

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear OpenSSH+ Monitorear openssh

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

63Vexday Risk Score

Prioriza la corrección. Ella explotación observada por VulnCheck y tiene prueba de concepto pública.

ssvc Actcvss 8.1epss 1.0%
de la publicación al armael mismo día
Publicada en NVD5 nov
1ª PoC5 nov
VulnCheck+1d
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
OpenBSD · OpenSSH
PoCs públicas encontradas — 30
githubgithub.com/gabrielunknown/CVE-2026-123158_SSHole★ 4githubgithub.com/Maalfer/CVE-2026-123158★ 2githubgithub.com/HackSpeak/CVE-2026-123158★ 1githubgithub.com/halilkirazkaya/CVE-2026-123158★ 1githubgithub.com/ersinkoc/sshole-check★ 1githubgithub.com/rothoma2/cve-2026-123158-sshole★ 1githubgithub.com/0xBlackash/CVE-2026-123158★ 1githubgithub.com/CriticalWombat/sshole_scanner-CVE-2026-123158★ 0githubgithub.com/mc493/openssh-musl-enterprise--hardening-cve-2026-123158★ 0githubgithub.com/crash00xd/CVE-2026-123158_SSHRole_PoC★ 0githubgithub.com/lpizziniacofortinet/cve-2026-123158-openssh-musl-lab★ 0githubgithub.com/Funcan/sshole★ 0githubgithub.com/ansonhsu-ai/sshhole-cve-2026-123158-ste★ 0githubgithub.com/akarkode/alpine-openssh-sshole-auth-bypass★ 0githubgithub.com/techtaek77/sshole-guide★ 0githubgithub.com/techdevfun/alpinegate★ 0githubgithub.com/Hel1um17/sshole-bypass-openssh-password★ 0githubgithub.com/mlazzarotto/ansible-sshole-remediate★ 0githubgithub.com/shenxianpeng/check-sshole★ 0githubgithub.com/coboliqcom/cve-2026-123158-sshole-safe-rust★ 0githubgithub.com/The-DevOps-Daily/alpine-sshd-check★ 0vulncheckvulncheck.com/xdb/44a873061bb1no verificadovulncheckvulncheck.com/xdb/8debe7c7b9ecno verificadocve_referencesshhole.comno verificadovulncheckvulncheck.com/xdb/9d1582c48f8ano verificadovulncheckvulncheck.com/xdb/86b3f3f82a77no verificadovulncheckvulncheck.com/xdb/84c81bd8e8d7no verificadovulncheckvulncheck.com/xdb/ad17010a7380no verificadovulncheckvulncheck.com/xdb/b5df0dc58ae0no verificadovulncheckvulncheck.com/xdb/f9114b78acb5no verificado
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — OpenBSD OpenSSH

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-60000LOWCVE-2026-60000EPSS 0.6%CVE-2026-35385HIGHCVE-2026-35385EPSS 0.6%CVE-2025-61984LOWCVE-2025-61984EPSS 0.5%CVE-2026-106552MEDIUMCVE-2026-106552EPSS 0.4%CVE-2026-35386LOWCVE-2026-35386EPSS 0.3%CVE-2026-60002HIGHCVE-2026-60002EPSS 0.3%