EUVD-2026-117552
GHSA-4fcc-vm97-gx3x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify musl/Alpine sshd with password auth exposed
-
DeliveryTarget account with susceptible (non-hash) password field
-
ExploitSubmit 256-1024 character password
-
ExecutionBypass password verification
-
ImpactGain authenticated shell as the account
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Status code handling
|
| Exploitation Conditions | Requires an OpenSSH sshd before 10.6p2 built against musl libc and WITHOUT PAM (the description's named example is Alpine Linux), with password authentication enabled, and an account in one of the susceptible configurations where the stored password field is not a valid hash (e.g. an absent/too-short crypt field that musl's crypt misinterprets). For such accounts, any password of 256-1024 characters authenticates successfully. Exploitation is LIMITED by: builds using PAM are not affected; glibc-based systems are not affected; password authentication must be enabled in sshd; only 'some configurations of accounts' are susceptible; and the attacker-supplied password must fall within the 256-1024 character window. No user interaction or prior authentication is required against a vulnerable target (PR:N/UI:N). |
| Impact | CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a network-reachable, unauthenticated (PR:N) authentication bypass with full confidentiality, integrity and availability impact, which looks severe in isolation. However, AC:H and the description together show the real-world reach is narrow: the flaw only affects OpenSSH built against musl libc WITHOUT PAM (the cited example being Alpine Linux) and only for 'some configurations of accounts', with success requiring a password of 256-1024 characters - so glibc hosts and any build using PAM are not affected. The vuln.today decision label is 'this_week' (a prioritize-soon signal, not emergency/act_now). It is NOT in CISA KEV, so this is 'no public exploit identified as actively exploited' status for active-exploitation purposes; however, the input lists reproduction/lab repositories (sshhole-repro, sshhole-lab), so a public PoC reference exists but it is not verified as working exploit code - do not treat this as confirmed active exploitation. EPSS is NOT provided in the input, so probabilistic exploitation likelihood cannot be weighed; this missing signal should be filled in before final triage. Net: a genuinely serious pre-auth bypass for the specific musl-without-PAM population (notably Alpine-based hosts/containers running password SSH), but materially constrained by the build/configuration preconditions rather than a universally exploitable OpenSSH flaw. |
| Exploit ScenarioDerived | An attacker reaches an internet- or network-exposed sshd on an Alpine/musl host that has password authentication enabled and a susceptible account whose stored password field is not a valid hash. The attacker submits any password between 256 and 1024 characters for that account and is authenticated without knowing the real credential, gaining shell access. Public reproduction repositories (sshhole-repro, sshhole-lab) are referenced, but they are not verified as working weaponized exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 05, 2026
Password authentication bypass in OpenSSH sshd before 10.6p2 built against musl libc without PAM lets a remote, unauthenticated attacker log in to susceptible accounts by supplying any password between 256 and 1024 characters. Affected targets are narrow: PAM-enabled builds, glibc-based systems, and deployments with password authentication disabled are not exposed, and only 'some configurations of accounts' (where the stored password field is not a valid hash) are susceptible. Rated CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) with a 'this_week' priority; CISA KEV status is not indicated and no verified working exploit code is confirmed, although public PoC lab/reproduction repositories exist.
RemediationAI
Upgrade to OpenSSH 10.6p2, which contains the fix (vendor release notes: https://www.openssh.org/releasenotes.html#10.6p2; upstream change: https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482), and rebuild against musl so the corrected auth-passwd.c/xcrypt.c code is compiled in. Where an immediate upgrade is not possible on musl-without-PAM hosts, removing the exposure conditions described in the advisory is the direct lever: because exploitation requires password authentication to be enabled in sshd, restricting sshd to public-key (or other non-password) authentication eliminates the attack path, at the cost of losing password logins for users who rely on them; switching to a PAM-enabled or glibc-based build also places the host outside the affected configuration, though that is a larger platform change. Operators should additionally review accounts whose stored password field is not a valid hash, since those are the configurations the bypass targets. Public reproduction/lab repositories referenced in the advisory (https://github.com/predkambrij/sshhole-repro and https://github.com/leonjza/sshhole-lab) are useful for validating whether a given Alpine-style deployment is exposed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified CWE-394 (Unexpected Status Code or Return Value) and lives in sshd's Unix password check path (auth-passwd.c sys_auth_passwd, with companion changes in openbsd-compat/xcrypt.c and port-uw.c). On platforms using musl libc without PAM, OpenSSH relies on its own crypt() compatibility wrapper; when the stored password field for an account is not a valid password hash (absent or too short), that string could be misinterpreted as a hash and the comparison outcome returned as a success. The upstream fix commit 4353fdc43ef646c43a8dda7025cc1a898caf1482 hardens this by introducing a MIN_PASSWORD_HASH_LEN of 4 and rejecting authentication when the retrieved password field is shorter than that, by returning a clear status through a dedicated ret variable, and by converting the shadow_pw()/pick_salt() handling to xstrdup()-based allocations that the caller frees with freezero() so credential material is wiped. In other words, the root cause is a permissive return value / misinterpretation of a malformed stored credential, not a memory-safety bug; the trigger path requires the specific libc/PAM configuration described, and the exact account-level conditions are only characterized as 'some configurations of accounts'.
Know when Openssh gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Pre-auth network bypass (AV:N/PR:N/UI:N) but restricted to musl-without-PAM builds, specific account configs and a 256-1024 char password window, hence AC:H; a successful bypass yields full account access (C/I/A:H).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
Articles & Coverage 1
Technical POC Analysis
No patch diff, commit, or source listing is present in the supplied evidence - the only artifacts are the CVE record text and a CIRCL/Previdian KEV catalog entry.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 public PoC link from nuclei
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
A high-severity authentication bypass in OpenSSH sshd (before 10.6p2) affects systems built against musl libc without PAM, allowing a remote attacker to log in with an arbitrary password. Exposure is limited to a narrow configuration subset, but any affected host could yield full compromise of susceptible accounts, so leadership should prioritize identifying at-risk infrastructure.
No vendor-released patch identified at time of analysis. Interim mitigations: disable password authentication and enforce key-based auth, restrict SSH to trusted networks, and audit or lock accounts with invalid stored password hashes. A public PoC reference exists; it is not verified as working exploit code.
Threat Model
4 threats: Elevation of Privilege, Spoofing, Information Disclosure and 1 more
5-step attack chain with trust boundaries and controls
Full threat model - attack chain, trust boundaries, controls per stage and evidence - is part of the Pro and Business plans.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remot
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. Rated medium se
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processin
The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password a
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
An issue was discovered in OpenSSH 7.9. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. Rated medium severity (CVSS 6.8), this
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote serv
Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to
In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-T
Exploit-DB