[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fhClvPohH1NZj_6MiVVXNKgabToI6BnehlfGRWpUWwEw":3,"g5a-risk:CVE-2026-123158":221},{"success":4,"data":5,"meta":218},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":31,"epssPercentile":25,"epssTimeSeries":32,"severity":36,"affectedProducts":37,"affectedProductsCount":51,"references":52,"referencesCount":127,"weaknesses":128,"weaknessesCount":137,"isActivelyExploited":4,"cisaInfo":138,"otxData":25,"relatedBlogPosts":139,"seoMetadata":140,"configurations":165,"relatedVendorCves":196,"notableEvents":197},"CVE-2026-123158","What is CVE-2026-123158?","sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.","sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpreta...","2026-11-05T16:17:47.11","2026-11-10T13:48:52.11",8.1,"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"CVSSMetricV31":15,"CVSSMetricV30":28,"CVSSMetricV2":29,"CVSSMetricV40":30},[16],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":26,"ImpactScore":27},"cve@mitre.org","Secondary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":22,"IntegrityImpact":22,"AvailabilityImpact":22,"BaseScore":12,"BaseSeverity":22,"ExploitCodeMaturity":25,"RemediationLevel":25,"ReportConfidence":25,"TemporalScore":25,"TemporalSeverity":25,"ConfidentialityRequirement":25,"IntegrityRequirement":25,"AvailabilityRequirement":25,"ModifiedAttackVector":25,"ModifiedAttackComplexity":25,"ModifiedPrivilegesRequired":25,"ModifiedUserInteraction":25,"ModifiedScope":25,"ModifiedConfidentialityImpact":25,"ModifiedIntegrityImpact":25,"ModifiedAvailabilityImpact":25,"EnvironmentalScore":25,"EnvironmentalSeverity":25},"3.1","NETWORK","HIGH","NONE","UNCHANGED",null,2.2,5.9,[],[],[],0.189,[33,33,34,34,35,35,31],0.00976,0.01014,0.16501,"High",[38,43,46],{"vendor":39,"product":40,"version":41,"criteria":42,"vulnerable":4},"openbsd","openssh","*","cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*",{"vendor":39,"product":40,"version":44,"criteria":45,"vulnerable":4},"10.6","cpe:2.3:a:openbsd:openssh:10.6:-:*:*:*:*:*:*",{"vendor":47,"product":48,"version":41,"criteria":49,"vulnerable":50},"alpinelinux","alpine_linux","cpe:2.3:o:alpinelinux:alpine_linux:*:*:*:*:*:*:*:*",false,3,[53,59,63,66,70,76,81,84,89,93,97,100,103,106,109,114,118,122],{"url":54,"source":55,"tags":56},"https:\u002F\u002Fgithub.com\u002Fleonjza\u002Fsshhole-lab","GitHub",[57,58],"Exploit","Third Party Advisory",{"url":60,"source":55,"tags":61},"https:\u002F\u002Fgithub.com\u002Fopenssh\u002Fopenssh-portable\u002Fcommit\u002F4353fdc43ef646c43a8dda7025cc1a898caf1482",[62],"Patch",{"url":64,"source":55,"tags":65},"https:\u002F\u002Fgithub.com\u002Fpredkambrij\u002Fsshhole-repro",[57,58],{"url":67,"source":68,"tags":69},"https:\u002F\u002Fhachyderm.io\u002F@damienmiller\u002F117563026759098135","Hachyderm",[58],{"url":71,"source":72,"tags":73},"https:\u002F\u002Fmarc.info\u002F?l=openssh-unix-dev&m=179388064263131&w=2","Marc",[74,75],"Mailing List","Vendor Advisory",{"url":77,"source":78,"tags":79},"https:\u002F\u002Fnews.ycombinator.com\u002Fitem?id=50377976","Ycombinator",[80],"Issue Tracking",{"url":82,"source":78,"tags":83},"https:\u002F\u002Fnews.ycombinator.com\u002Fitem?id=50378228",[80],{"url":85,"source":86,"tags":87},"https:\u002F\u002Fwww.openssh.org\u002Freleasenotes.html#10.6p2","Openssh",[88],"Release Notes",{"url":90,"source":91,"tags":92},"http:\u002F\u002Fwww.openwall.com\u002Flists\u002Foss-security\u002F2026\u002F11\u002F09\u002F27","Openwall",[74],{"url":94,"source":95,"tags":96},"https:\u002F\u002Falpinelinux.org\u002Fposts\u002F2026-11-05-openssh-password-authentication-bypass\u002F","Alpinelinux",[58],{"url":98,"source":55,"tags":99},"https:\u002F\u002Fgithub.com\u002Fcoollabsio\u002Fcoolify\u002Fdiscussions\u002F12484",[58],{"url":101,"source":55,"tags":102},"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fgoonami-scanner\u002Fpull\u002F277",[58],{"url":104,"source":55,"tags":105},"https:\u002F\u002Fgithub.com\u002Fpanubo\u002Fdocker-sshd\u002Fissues\u002F93",[58],{"url":107,"source":78,"tags":108},"https:\u002F\u002Fnews.ycombinator.com\u002Fitem?id=50379704",[80],{"url":110,"source":111,"tags":112},"https:\u002F\u002Fisc.sans.edu\u002Fdiary.html?storyid=33498","Sans",[113],"Not Applicable",{"url":115,"source":116,"tags":117},"https:\u002F\u002Fsshhole.com","Sshhole",[58],{"url":119,"source":120,"tags":121},"https:\u002F\u002Fsshole.events.greynoise.io\u002F","Greynoise",[58],{"url":123,"source":124,"tags":125},"https:\u002F\u002Fwww.cisa.gov\u002Fknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-123158","CISA",[126],"US Government Resource",18,[129],{"id":130,"name":131,"description":132,"extendedDescription":133,"status":134,"abstraction":135,"structure":136},"CWE-394","Unexpected Status Code or Return Value","The product does not properly check when a function or operation returns a value that is legitimate for the function, but is not expected by the product.","","Draft","Base","Simple",1,{"shortDescription":133,"requiredAction":133,"vulnerabilityName":133,"dateAdded":25},[],{"title":141,"metaDescription":142,"keywords":143,"canonicalUrl":144,"structuredData":145},"What is CVE-2026-123158? Vulnerability Analysis | Security Advisory | EdgeProtect","Comprehensive analysis of CVE-2026-123158, a high severity cyber security vulnerability from 2026. sshd in OpenSSH before 10.6p2 on Linux, when musl libc is ...","CVE-2026-123158, CVE-2026-123158 vulnerability, CVE-2026-123158 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2026, CVSS score, exploit, patch, remediation, openbsd security, alpinelinux security, openssh vulnerability, alpine_linux vulnerability","\u002Fwhat-is\u002Fcve-2026-123158",{"@context":146,"@type":147,"headline":141,"description":142,"datePublished":10,"dateModified":11,"author":148,"publisher":152,"about":156,"mainEntityOfPage":160,"articleSection":163,"keywords":164},"https:\u002F\u002Fschema.org","TechArticle",{"@type":149,"name":150,"url":151},"Organization","EdgeProtect","https:\u002F\u002Fedgeprotect.io",{"@type":149,"name":150,"url":151,"logo":153},{"@type":154,"url":155},"ImageObject","https:\u002F\u002Fedgeprotect.io\u002Fimg\u002Flogos\u002Fedgeprotect-logo-512.png",{"@type":157,"name":6,"description":158,"additionalType":159},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":161,"@id":162},"WebPage","https:\u002F\u002Fedgeprotect.io\u002Fwhat-is\u002Fcve-2026-123158","Cybersecurity","CVE-2026-123158, CVE-2026-123158 vulnerability, CVE-2026-123158 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[166],{"Operator":167,"Negate":25,"Nodes":168},"AND",[169,179],{"Operator":170,"Negate":50,"CPEMatch":171},"OR",[172,174,176],{"Vulnerable":4,"Criteria":42,"MatchCriteriaID":173,"VersionStartExcluding":25,"VersionStartIncluding":25,"VersionEndExcluding":44,"VersionEndIncluding":25},"09209468-5A53-45C0-8698-8C668E53EBEA",{"Vulnerable":4,"Criteria":45,"MatchCriteriaID":175,"VersionStartExcluding":25,"VersionStartIncluding":25,"VersionEndExcluding":25,"VersionEndIncluding":25},"4C93748B-FD1E-4BD4-9D18-0D4D2BD9C518",{"Vulnerable":4,"Criteria":177,"MatchCriteriaID":178,"VersionStartExcluding":25,"VersionStartIncluding":25,"VersionEndExcluding":25,"VersionEndIncluding":25},"cpe:2.3:a:openbsd:openssh:10.6:p1:*:*:*:*:*:*","AD8BE997-294C-4E7A-A714-6FCED9884258",{"Operator":170,"Negate":50,"CPEMatch":180},[181,184,188,192],{"Vulnerable":50,"Criteria":49,"MatchCriteriaID":182,"VersionStartExcluding":25,"VersionStartIncluding":25,"VersionEndExcluding":183,"VersionEndIncluding":25},"70B1C408-9879-44A0-ADA0-5E0B0B3447EA","3.21.10",{"Vulnerable":50,"Criteria":49,"MatchCriteriaID":185,"VersionStartExcluding":25,"VersionStartIncluding":186,"VersionEndExcluding":187,"VersionEndIncluding":25},"D4963B56-DEDA-43CE-B636-6715C4C3C1EE","3.22.0","3.22.8",{"Vulnerable":50,"Criteria":49,"MatchCriteriaID":189,"VersionStartExcluding":25,"VersionStartIncluding":190,"VersionEndExcluding":191,"VersionEndIncluding":25},"3C30A060-F2D9-4A44-A839-7CE86E222A88","3.23.0","3.23.8",{"Vulnerable":50,"Criteria":49,"MatchCriteriaID":193,"VersionStartExcluding":25,"VersionStartIncluding":194,"VersionEndExcluding":195,"VersionEndIncluding":25},"3A5F114B-8B24-43BB-AF9C-F2AB8A12F3B0","3.24.0","3.24.4",[],[198,205,212],{"id":199,"eventType":200,"eventTime":201,"details":202,"label":203,"color":204},"416b4e7f-4688-4d97-b9af-e11aaf21e615","NEW_NVD","2026-11-06T04:02:11.058779+00:00","New CVE added to NVD","Published to NVD","blue",{"id":206,"eventType":207,"eventTime":208,"details":209,"label":210,"color":211},"a7d63f75-48da-4cc3-9fa5-64ba72f8850d","NEW_CISA","2026-11-10T04:01:11.978867+00:00","CVE added to CISA Known Exploited Vulnerabilities","Added to CISA KEV","red",{"id":213,"eventType":214,"eventTime":215,"details":216,"label":217,"color":211},"9727de30-3688-4771-8b52-8e91ede088a8","HIGH_EPSS_DELTA","2026-11-11T04:08:03.908275+00:00","Daily EPSS score increased by 0.155 on 2026-11-07","EPSS Score Increased",{"lastModified":11,"cacheTime":219,"version":220},1794566356663,"2.0",{"score":222,"band":36,"action":223,"scoredAt":224},81,"Emergency patch","2026-11-13T07:27:11.443947+00:00"]