sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
? CVE-2026-123158 · score 8.1/10
What could go wrong?
Microsoft fixed a security weakness. Details are limited to avoid helping attackers.
How urgent is it?
Check Microsoft’s page for details.
Who is affected?
azl3 openssh 9.8p1-10 on Azure Linux 3.0
What should I do?
Install this month’s updates via Windows Update, Intune or your update tool, then restart.
Known problems
Microsoft lists known issues per update: no KB article listed. Official page.