Security Advisory

OpenSSH Security Update Advisory (CVE-2026-123158)

  • Nov 09 2026
OpenSSH Security Update Advisory (CVE-2026-123158)

Overview

An authentication bypass vulnerability (CVE-2026-123158) has been identified due to a password-handling error in OpenSSH. Users of this product should update to the latest version.

Affected Parties

  • OpenSSH (musl-based Linux) versions earlier than 10.6p2. – All versions of Alpine Linux 3.15 or earlier (OpenSSH). – Alpine Linux 3.16 (OpenSSH) versions earlier than 9.0_p1-r6.
  • Alpine Linux 3.17 (OpenSSH) versions earlier than 9.1p1-r7. – Alpine Linux 3.18 (OpenSSH) versions earlier than 9.3p2-r4.
  • Alpine Linux 3.19 (OpenSSH) versions earlier than 9.6p1-r3. – Alpine Linux 3.20 (OpenSSH) versions earlier than 9.7p1-r6.
  • Alpine Linux 3.21 (OpenSSH) versions earlier than 9.9_p2-r1.
  • Alpine Linux 3.22 (OpenSSH) versions earlier than 10.0p1-r11. – Alpine Linux 3.23 (OpenSSH) versions earlier than 10.2p1-r1.
  • Alpine Linux 3.24 (OpenSSH) versions earlier than 10.3p1-r2. – Alpine Linux edge (OpenSSH) versions earlier than 10.6p2-r0.

Vulnerability Details

This vulnerability is an authentication bypass vulnerability (CVE-2026-123158) caused by a password-handling error in OpenSSH. A patch has been provided via a security update.

Action Items

Follow the instructions on the reference website to update to the latest version that includes the Vulnerability Patches.

Note

  • Security advisory: openssh-server password authentication bypass.
  • OpenSSH Release Notes.

Tags:
Previous Post