OpenSSH CVE-2026-123158: password authentication bypass on Linux, added to KEV (due 12 Nov)
CISA added it on 9 Nov, describing an unexpected return value flaw that could allow authentication bypass. Per the Alpine advisory (5 Nov), an attacker who can reach the SSH port can log in with one connection by sending a very long password (257 to 1024 bytes) for an account whose password field is '*', provided the machine has at least one other account with a $5$ or $6$ password hash. It affects builds without PAM (or UsePAM no) with PasswordAuthentication yes, which is the OpenSSH default. Alpine says it is not affected if sshd is not running (most containers), PasswordAuthentication is no, or UsePAM yes is used. The fix is OpenSSH 10.6p2 or your distro's patched package, and the daemon must be restarted after the upgrade. Check now: sshd -T | grep -iE 'passwordauthentication|usepam'. Until you patch, set PasswordAuthentication no. Check your own distro's advisory, since the Alpine one covers Alpine only.