AS-2026-025: OpenSSH (SSHole)

2026-11-09

---

Statement

OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability (CVE-2026-123158).

None of ASUSTOR's products are affected by CVE-2026-123158 as the OpenSSH package in ASUSTOR products does not use musl libc.

Affected Products

Product	Severity	Fixed Release Availability
ADM 5.0 and 5.1	Not affected	N/A
ADM 4.3, 4.2 and 4.1	Not affected	N/A

Detail

• CVE-2026-123158
  • Severity: High
  • CVSS4 Base Score: 8.1
  • CVSS4 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  • sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.

Reference

• CVE-2026-123158
• OpenSSH Release Notes

Revision

Revision	Date	Description
1	2026-11-06	Initial public release.