CVE-2026-123158 affecting OpenSSH on Linux

This section contains time sensitive announcements about specific cyber threats, vulnerabilities and scams. Each alert has information you need to be aware of, and what actions to take to mitigate any risk to you or your organisation.

Subscribe to our updates to be notified as soon as we publish an alert.

3:45PM, 11 November 2026

TLP Rating: Clear

CVE-2026-123158 affecting OpenSSH on Linux

An authentication bypass vulnerability, tracked as CVE-2026-123158 ("SSHole") may allow attackers to gain root access on systems running certain OpenSSH configurations on Linux. OpenSSH is the most common tool for remote login over the SSH protocol. Organisations should assess potentially affected systems and apply vendor-provided patches or mitigations as they become available.

What's happening

Systems affected

OpenSSH on Linux systems where all of the following conditions are true:

before version 10.6p2
runs on musl libc
does not use Pluggable Authentication Modules (PAM)
accepts password logins

What to do

Prevention

Update to OpenSSH version 10.6p2

Mitigation

Disable password authentication (on by default in OpenSSH) or disable SSH.

More information

Identify potentially affected products within your environment and refer to the corresponding vendor guidance External Link for remediation and mitigation requirements.