What happened
CVE‑2026‑123158 is an authentication bypass in OpenSSH when built without PAM and with PasswordAuthentication enabled on musl‑based Linux distributions. An attacker who can reach the SSH port sends a password string 257‑1024 bytes long; musl’s crypt() returns the literal "*", which the daemon treats as a successful password check. The exploit works on every attempt, granting immediate access to any account, including those with password authentication disabled. Alpine Linux released a security advisory with a patch; other affected distros include Adélie, Void, Sabotage, OpenWrt, and Yocto‑based builds.
Why it matters for trust and compliance
- The flaw demonstrates why continuous verification of authentication controls and evidence of proper PAM integration are essential for control‑assurance programs.
- Map authentication hardening controls to audit evidence requirements across frameworks.
- Leverage continuous monitoring to detect misconfigurations in SSH services before exploitation.
Who is affected
Cloud service providers Embedded‑system manufacturers SaaS platforms running Alpine or other musl‑based Linux
Recommended actions
- Apply the OpenSSH patch and restart the sshd service immediately.
- Disable PasswordAuthentication or enable PAM to enforce proper credential checks.
- Audit recent SSH logs for unauthorized logins and update hardening baselines.