{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/actors/0xblackash/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["0xBlackash"],"_cs_cpes":["cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-123158"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenSSH (\u003c 10.6p2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"threat","_cs_vendors":["OpenBSD"],"content_html":"\u003cp\u003eCVE-2026-123158, dubbed \u0026quot;SSHhole,\u0026quot; is an authentication bypass vulnerability in OpenSSH. The vulnerability stems from an interaction between the musl libc \u003ccode\u003ecrypt()\u003c/code\u003e function and OpenSSH password verification logic. When an attacker provides a password between 256 and 1024 characters, \u003ccode\u003ecrypt()\u003c/code\u003e may return an asterisk \u003ccode\u003e*\u003c/code\u003e as an error indicator. If an account is configured with \u003ccode\u003e*\u003c/code\u003e as its stored password hash (commonly used for disabled or key-only accounts), the OpenSSH authentication routine may interpret the match as successful, granting unauthorized access.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies an OpenSSH target running on a musl libc-based Linux distribution without PAM.\u003c/li\u003e\n\u003cli\u003eAttacker enumerates accounts configured for key-only authentication (often identified by \u003ccode\u003e*\u003c/code\u003e in the shadow file).\u003c/li\u003e\n\u003cli\u003eAttacker initiates an SSH password authentication attempt.\u003c/li\u003e\n\u003cli\u003eAttacker provides a crafted password string between 256 and 1024 characters.\u003c/li\u003e\n\u003cli\u003eThe target's \u003ccode\u003ecrypt()\u003c/code\u003e function returns \u003ccode\u003e*\u003c/code\u003e due to length overflow.\u003c/li\u003e\n\u003cli\u003eOpenSSH logic compares the returned \u003ccode\u003e*\u003c/code\u003e with the account's stored \u003ccode\u003e*\u003c/code\u003e hash.\u003c/li\u003e\n\u003cli\u003eOpenSSH erroneously confirms the password match.\u003c/li\u003e\n\u003cli\u003eAttacker gains unauthorized access to the target account.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthorized SSH access to affected accounts. The level of access gained depends on the privileges of the targeted account.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to OpenSSH 10.6p2 or later immediately to resolve the authentication logic flaw.\u003c/li\u003e\n\u003cli\u003eDisable password authentication on systems where it is not strictly required by setting \u003ccode\u003ePasswordAuthentication no\u003c/code\u003e in \u003ccode\u003esshd_config\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eInventory systems using musl libc to identify high-risk assets, particularly Alpine Linux and embedded device environments.\u003c/li\u003e\n\u003cli\u003eAudit SSH logs for unexpected successful password authentication events, specifically for accounts normally restricted to SSH keys.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-05T23:53:32Z","date_published":"2026-11-05T23:53:32Z","id":"https://feed.craftedsignal.io/briefs/2026-11-openssh-auth-bypass-97dae15e/","summary":"CVE-2026-123158 is an authentication bypass vulnerability in OpenSSH running on Linux systems using musl libc without PAM, potentially allowing unauthorized access via long password submissions.","title":"OpenSSH: Password authentication bypass (CVE-2026-123158)","url":"https://feed.craftedsignal.io/briefs/2026-11-openssh-auth-bypass-97dae15e/"}],"language":"en","title":"CraftedSignal Threat Feed - 0xBlackash","version":"https://jsonfeed.org/version/1.1"}