CERT-FR relays OpenSSH 10.6p2 fix for sshd password authentication bypass (CVE-2026-123158)
The CERT-FR bulletin CERTFR-2026-AVI-1468 relays the OpenSSH 10.6p2 release of 5 November 2026. It covers CVE-2026-123158, a security policy bypass that CERT-FR attributes to OpenSSH versions before 10.6p2. The OpenSSH release notes describe a password authentication bypass in sshd(8) and call the fix a "critical security workaround" (openssh.org). The OpenSSH notes do not cite the CVE, which comes only from CERT-FR, so linking CVE-2026-123158 to the password bypass is an inference. The OpenSSH notes mention specific Linux builds (musl libc, PAM disabled). The CERT-FR page also carries an unrelated banner about a notification campaign targeting Apple phones on 29 October 2026.
Entenda a falha
A vulnerabilidade
CVE-2026-123158 is described by CERT-FR as a security policy bypass in OpenSSH versions before 10.6p2. The OpenSSH 10.6p2 release notes describe a password authentication bypass in sshd(8) and call the fix a "critical security workaround". The notes do not cite the CVE, so tying it to the password bypass is an inference by Tifon from the CERT-FR bulletin. The notes say the problem affects some Linux systems where OpenSSH is built and run with PAM support disabled, and they name musl libc with PAM disabled as the affected profile. The sources give no CVSS score and no full list of affected versions. Fixed in 10.6p2.
Como funciona
The sources do not describe the step-by-step flow. What they say is that sshd handles password authentication, and that on Linux builds using musl libc with PAM disabled, a problem outside sshd lets password authentication be bypassed. Because of that, sshd carries a workaround for it. The exact point where the check fails is not given.
Por que é vulnerável
According to the OpenSSH release notes, the root cause lies outside sshd, but sshd can be exploited through it. The fix is therefore a workaround inside sshd rather than a repair of the underlying component. The sources do not name that component or explain why the issue went unnoticed.
Como foi descoberta
The OpenSSH release notes credit the report to Özgün Kültekin of Wakefield. OpenSSH published 10.6p2 on 5 November 2026 and CERT-FR relayed it in bulletin CERTFR-2026-AVI-1468. The CVE identifier comes only from CERT-FR. The sources read mention no exploitation in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 06/11/2026 12:28.
Detalhes técnicos
According to the OpenSSH release notes, the root cause lies outside sshd, but sshd can be exploited through it, so the workaround is in sshd (openssh.org). The notes say it affects some Linux systems when OpenSSH is built and run with PAM support disabled. The introduction names musl libc together with PAM being disabled as the affected profile, so the notes read during research describe one combined configuration: Linux, musl libc, PAM disabled (openssh.org). The CVE identifier comes from the CERT-FR bulletin. The OpenSSH release notes read during research do not cite it, and they do not give a full list of affected versions. They list the fix as a change since 10.6p1 (openssh.org). The flaw was reported by Özgün Kültekin of Wakefield (openssh.org). The sources read do not mention exploitation in the wild or give a CVSS score.
Remediação
CERT-FR directs readers to the OpenSSH 10.6p2 bulletin for the fix and lists versions before 10.6p2 as affected. Upgrade OpenSSH to 10.6p2 or later. According to the OpenSSH notes, the practical risk concerns builds with PAM disabled on Linux systems using musl libc (openssh.org). Administrators should check whether their builds match that profile.
Linha do tempo
-
CERT-FR relays OpenSSH 10.6p2 fix for sshd password authentication bypass (CVE-2026-123158)
ler a análise desta fonte ocultar
The CERT-FR bulletin CERTFR-2026-AVI-1468 relays the OpenSSH 10.6p2 release of 5 November 2026. It covers CVE-2026-123158, a security policy bypass that CERT-FR attributes to OpenSSH versions before 10.6p2. The OpenSSH release notes describe a password authentication bypass in sshd(8) and call the fix a "critical security workaround" (openssh.org). The OpenSSH notes do not cite the CVE, which comes only from CERT-FR, so linking CVE-2026-123158 to the password bypass is an inference. The OpenSSH notes mention specific Linux builds (musl libc, PAM disabled). The CERT-FR page also carries an unrelated banner about a notification campaign targeting Apple phones on 29 October 2026.
Technical Details
According to the OpenSSH release notes, the root cause lies outside sshd, but sshd can be exploited through it, so the workaround is in sshd (openssh.org). The notes say it affects some Linux systems when OpenSSH is built and run with PAM support disabled. The introduction names musl libc together with PAM being disabled as the affected profile, so the notes read during research describe one combined configuration: Linux, musl libc, PAM disabled (openssh.org). The CVE identifier comes from the CERT-FR bulletin. The OpenSSH release notes read during research do not cite it, and they do not give a full list of affected versions. They list the fix as a change since 10.6p1 (openssh.org). The flaw was reported by Özgün Kültekin of Wakefield (openssh.org). The sources read do not mention exploitation in the wild or give a CVSS score.
Remediation
CERT-FR directs readers to the OpenSSH 10.6p2 bulletin for the fix and lists versions before 10.6p2 as affected. Upgrade OpenSSH to 10.6p2 or later. According to the OpenSSH notes, the practical risk concerns builds with PAM disabled on Linux systems using musl libc (openssh.org). Administrators should check whether their builds match that profile.