What happened

On 9 November 2026, CISA added CVE-2026-123158 to its Known Exploited Vulnerabilities (KEV) catalog. Four days earlier, OpenSSH had released 10.6p2 with a workaround for a password authentication bypass affecting certain Linux configurations that use musl libc with PAM disabled. [1] [2]

Alpine’s advisory explains that the flaw also requires password authentication to be enabled and specific account and password-hash configurations. Alpine provides patched package revisions for multiple branches, including older releases. The upstream version number alone therefore cannot establish whether a distribution package includes the fix. [3]

Why it matters for manufacturers

An embedded product’s security depends on decisions made during both the build and provisioning process. Two firmware images containing OpenSSH may use different C libraries, authentication methods, and account policies. Assessing whether a vulnerability applies requires checking the deployed configuration as well as the installed component.

Deployment must also be verified. Alpine notes that upgrading the package does not replace an already running SSH daemon; the service must be restarted. A manufacturer’s validation process should trace the fix from the source to the rebuilt image and confirm that the device is running the patched service. [3]

What to review in your firmware

  • Identify the C library, OpenSSH package revision, PAM configuration, and effective authentication settings for each supported image.
  • Check the package revision and patch history to confirm whether the upstream fix has been applied, directly or through a vendor backport.
  • Verify that valid logins succeed and invalid logins are rejected, then check service restarts and management access with the rebuilt firmware.

The engineering takeaway

Confirm that the fix is present in the source, included in the firmware image, and active on the device. Build records and package inventories should be supported by runtime validation.

Primary sources

  1. CISA: Known Exploited Vulnerabilities CatalogCVE-2026-123158 was added on 9 November 2026. Catalog reviewed on 13 November 2026.
  2. OpenSSH: Portable OpenSSH 10.6p2 release notes5 November 2026.
  3. Alpine Linux: openssh-server password authentication bypass5 November 2026. Covers affected configurations, patched package revisions, and service restart guidance.

Sources reviewed on . The manufacturer guidance and engineering takeaway reflect Firmdura’s analysis.