CISA Confirms Exploitation of OpenSSH Password Authentication Bypass
Tech GuruQuick Answer
Inspect susceptible non-PAM OpenSSH configurations, especially Alpine. Apply the matching fixed package and restart sshd; if patching must wait, validate key access before disabling password authentication. Preserve login and privilege-use logs.
Confirm Scope And Apply The Supported Remediation
What to do now: Record the distribution, openssh package, PAM and password-authentication configuration, relevant account password-field types, SSH exposure and recovery access without copying password hashes into tickets. Check every Alpine prerequisite in the authority advisory. Alpine says UsePAM yes with openssh-server-pam and PasswordAuthentication no are outside this path; containers without sshd are not affected through this service. Apply the supported distribution fix and restart sshd. Alpine lists edge 10.6_p2-r0; 3.24 10.3_p1-r2; 3.23 10.2_p1-r1; 3.22 10.0_p1-r11; 3.21 9.9_p2-r1; 3.20 9.7_p1-r6; 3.19 9.6_p1-r3; 3.18 9.3_p2-r4; 3.17 9.1_p1-r7; and 3.16 9.0_p1-r6. Pending update, disable password authentication using Alpine guidance. Confirm the running daemon uses the fixed package, validate sshd configuration and test a fresh authorized key login. Review accepted password logins for key-only accounts, privilege use, new accounts and authorized-key changes; retain findings.
Last verified: 2026-11-09 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Portable OpenSSH on susceptible Linux configurations; Alpine openssh-server |
|---|---|
| Advisory | CISA-KEV-CVE-2026-123158 |
| CVE | CVE-2026-123158 |
| CISA KEV addition and catalog release | November 9, 2026 (KEV addition); catalog released at 2026-11-09T16:16:16.4275Z. |
| Authority revision date | Original project advisory: 2026-11-05. Latest project revision: Not separately stated. The new material development is CISA KEV inclusion. |
| Affected versions | Alpine identifies non-PAM sshd, or openssh-server-pam with UsePAM no, with password authentication enabled, a login-capable account whose password field is *, and another account with a $5$ or $6$ password hash. Alpine checked releases 3.16 through 3.24 and edge. Do not generalize to every Linux/OpenSSH installation. |
| Fixed version | Portable OpenSSH 10.6p2; Alpine branch-specific patched packages listed below |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | CISA confirms exploitation through its November 9, 2026 KEV addition.; no exploitation claim is inferred. |
What Changed
CISA added CVE-2026-123158 to KEV on November 9. OpenSSH and Alpine describe a password-authentication bypass involving the error return from password hashing in certain non-PAM configurations. Alpine supplies backported packages and requires a daemon restart.
What To Validate Now
- Inventory. Record the distribution, openssh package, PAM and password-authentication configuration, relevant account password-field types, SSH exposure and recovery access without copying password hashes into tickets.
- Establish applicability. Check every Alpine prerequisite in the authority advisory. Alpine says UsePAM yes with openssh-server-pam and PasswordAuthentication no are outside this path; containers without sshd are not affected through this service.
- Remediate. Apply the supported distribution fix and restart sshd. Alpine lists edge 10.6_p2-r0; 3.24 10.3_p1-r2; 3.23 10.2_p1-r1; 3.22 10.0_p1-r11; 3.21 9.9_p2-r1; 3.20 9.7_p1-r6; 3.19 9.6_p1-r3; 3.18 9.3_p2-r4; 3.17 9.1_p1-r7; and 3.16 9.0_p1-r6. Pending update, disable password authentication using Alpine guidance.
- Validate. Confirm the running daemon uses the fixed package, validate sshd configuration and test a fresh authorized key login. Review accepted password logins for key-only accounts, privilege use, new accounts and authorized-key changes; retain findings.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Keep a tested recovery path and an existing administrative session while changing SSH settings. Updating the package alone does not replace the running daemon. Alpine warns that older tiny-cloud instances can become exposed after a password hash is added; exceptional fixes do not restore general support for obsolete releases. CISA lists November 12, 2026 as the due date and flags forensic triage. Federal readers should validate applicable directive requirements; other organizations should use their own incident and change procedures. Ransomware campaign use is listed as Unknown.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
