Posts tagged with "CVE-2026-123158"

OpenSSH 10.6p2, released 5 November 2026, closes CVE-2026-123158: on musl-based Linux without PAM, any password of 257 to 1,024 bytes logs in to any account whose shadow field is "*", which is the Alpine default for root and for the user in Alpine's own cloud images. Azure Linux and every endorsed distro are unaffected, so here is the audit for where it actually hides: Alpine VMs from VHDs, App Service custom containers built from Microsoft's SSH template, and sshd pods.