CISA Lists Exploited OpenSSH Bypass With 12th November Deadline
CISA has listed an exploited OpenSSH flaw, with a 12th November remediation date and a narrowly defined affected configuration.
The US Cybersecurity and Infrastructure Security Agency (CISA) has added an OpenSSH password bypass to its Known Exploited Vulnerabilities catalogue, listing 12th November 2026 as the remediation due date. The agency's 9th November alert says the additions are based on evidence of active exploitation.
The vulnerability does not affect every OpenSSH installation. The maintainers' announcement confines it to Linux systems using musl libc, a C software library, with password authentication operating without PAM, a system that handles applications' authentication tasks.
Alpine Linux is one example. The maintainers say non-Linux systems, Linux systems using glibc, and Linux systems using PAM for password authentication are unaffected.
The National Vulnerability Database entry, identified as CVE-2026-123158, says some account configurations can accept any password between 256 and 1,024 characters. OpenSSH released version 10.6p2 on 5th November with a workaround. Its maintainers consider the root cause to lie outside OpenSSH itself.
The federal deadline and its limits
CISA's alert places the catalogue within Binding Operational Directive 26-04, which applies to Federal Civilian Executive Branch agencies. CISA encourages other organisations to prioritise the same known exploited vulnerabilities; the directive does not impose that federal agency obligation on every OpenSSH operator.
The directive makes remediation timelines depend on an asset's exposure and other risk factors. The catalogue itself tells agencies to assess internet exposure and follow the directive's patching and forensic triage guidance. Its 12th November date should therefore be read alongside those asset-specific requirements.
Why the maintainers accelerated the release
In his 5th November announcement, OpenSSH maintainer Damien Miller said the team had learned of the problem the previous day. He said the team had recently seen AI agents independently rediscover bugs within hours, making long private disclosure periods dangerous in its assessment.
The project's release notes say it will make more frequent releases to get fixes to users sooner. They also distinguish the volume of AI-assisted reports from useful security findings: many reports lack security impact under a realistic threat model, while human analysis and proposed fixes improve their value.
That practical role for AI in finding flaws sits alongside the concerns in Bored Node's report on open AI security tools and concentrated power.
CISA's same batch also includes CVE-2026-102895 in GPUStack, software used to manage graphics processors for AI services. The NVD record says versions before 2.2.0 could let remote requests gain administrator access and execute code. It records exploitation against a version 2.1.1 deployment and identifies 2.2.0 as the fixed release. Bored Node's research on the AI computing supply chain examines the infrastructure on which those services depend.
