OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability
OpenBSD — OpenSSH
- Added to KEV catalog
- 9 November 2026
- Federal remediation due date
- 12 November 2026
- Weakness classification (CWE)
- CWE-394
AI Breakdown
What it is
OpenSSH running on specific Linux systems, such as Alpine Linux using musl libc without PAM, contains a flaw that allows attackers to bypass password authentication. Due to an error in how password hashes are verified, an attacker can log into certain accounts by submitting an arbitrary password between 256 and 1024 characters long. This allows unauthorized remote access to affected servers without requiring legitimate credentials.
Why it matters
This vulnerability carries a high CVSS severity score of 8.1 and is catalogued by CISA as actively exploited in the wild. Although confirmed use in ransomware campaigns is currently unknown, authentication bypass flaws on remote access services represent an immediate entry point for attackers. Unpatched systems exposed to the internet are at high risk of unauthorized compromise.
Recommended action
Identify all exposed Linux assets running OpenSSH before version 10.6p2 and upgrade them immediately in accordance with vendor guidance. If patches cannot be applied right away, implement vendor mitigations, follow CISA forensics triage and BOD 26-04 requirements, or discontinue use of the affected service. Federal agencies and partners must ensure these remediation steps are completed before the November 12, 2026 deadline.
AI-generated from CISA and NVD data — treat as a starting point, not a substitute for your own risk assessment.
CISA Description
OpenBSD OpenSSH on Linux contains an unexpected status code or return value vulnerability that could allow for authentication bypass.
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes
This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://www.openssh.org/releasenotes.html ; https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/ ; https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-123158
NVD Technical Description
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
More OpenBSD Vulnerabilities
Is this vulnerability present in your environment?
CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.
Explore VAPT Services