OpenSSH: flaw exploited in the wild

OpenBSD OpenSSH

An OpenSSH flaw is being exploited in the wild, allowing remote attackers to log into passwordless accounts.

Do this now

Check the OpenBSD OpenSSH vendor advisory for a fix and restrict SSH access to trusted networks meanwhile.

Who should check: teams running OpenSSH

First seen: 6 Nov 2026
Last update: 6 Nov 2026, 13:18 UTC
Versions per the CVE record from mitre, not the vendor: 10.6p2
Identifiers: CVE-2026-123158
CVSS: 8.1
Source: news
On the menu as: OpenSSH

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## OpenSSH: flaw exploited in the wild
Severity: high. Patch status: fix status unknown.
Affected: OpenBSD OpenSSH
Versions per the CVE record from mitre, not the vendor: 10.6p2
Ids: CVE-2026-123158

An OpenSSH flaw is being exploited in the wild, allowing remote attackers to log into passwordless accounts.

## Steps
1. This touches infrastructure (openssh). Look in terraform, ansible, cloud-init, Dockerfiles and docs for the product and version we run. If it isn't in the repo, say so and list what a human should check on the box.
2. Versions per the CVE record from mitre, not the vendor: OpenSSH: 10.6p2. Don't treat them as a fix until the vendor says so.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| OpenSSH | per the CVE record from mitre, not the vendor | 10.6p2 | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-123158") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://www.helpnetsecurity.com/2026/11/06/openssh-sshole-cve-2026-123158-exploitation/
https://pwned.coffee/i/openssh-flaw-exploited-in-the-wild-cve-2026-123158

Timeline

6 Nov 2026, 13:18 UTC
Fix status: patched → unknown.
6 Nov 2026
First reported.

Receipt

Exploitation: Public exploit code, no attacks reported
CISA ADP “CISA ADP rates exploitation of CVE-2026-123158 "poc" (SSVC).” source
Overheard “Sinisa Markovic , Managing Editor, Help Net Security November 6, 2026 OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158) An OpenSSH flaw that lets remote attackers log into passwordless accounts on Alpine Linux and other musl-based systems is bein…” source
By release line, per the CVE record from mitre, not the vendor: Product Affected Version named Source
OpenSSH before 10.6p2 10.6p2 CVE record (CNA) per the CVE record from mitre, not the vendor checked 6 Nov
Score: CVSS 8.1 (high). CVSS 3.1 8.1 (CNA mitre) for CVE-2026-123158
Last checked: 6 Nov 2026, 13:18 UTC

Product	Affected	Version named	Source
OpenSSH	before 10.6p2	10.6p2	CVE record (CNA) per the CVE record from mitre, not the vendor checked 6 Nov

Sources: KEV – CVE record ✓ Vendor –

Sources

helpnetsecurity.com: OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158)

Follow on X

Totalone hot coffee