OpenSSH, GPUStack and FreeSWITCH added to CISA’s KEV catalogue: password bypass and command execution under active exploitation

The US Cybersecurity and Infrastructure Security Agency (CISA) on Monday, November 9, 2026 added four vulnerabilities already being exploited in attacks to its Known Exploited Vulnerabilities (KEV) catalogue. Three open the door to servers without a password or allow remote command execution: CVE-2026-123158 in OpenBSD’s OpenSSH, CVE-2026-102895 in GPUStack and CVE-2026-116779 in SignalWire’s FreeSWITCH. The fourth, CVE-2026-123218 in IBM Aspera Faspex, lets a user with an account bypass authorisation checks with a specially crafted message and gain elevated privileges.

The patch deadline is Thursday, November 12, three days after listing, and applies to all four entries. It binds only civilian federal executive agencies (FCEB), under directive BOD 26-04, which asks for rapid remediation of vulnerabilities in internet-exposed systems when they can give an attacker full control, and for a check of whether the system was compromised before patching (forensic triage). For all the additions, the catalogue notes it is unknown whether they have been used in ransomware attacks. CISA urges every organisation to prioritise KEV entries.

OpenSSH on musl-based Linux

For OpenSSH, the catalogue speaks of an unexpected return value that allows authentication bypass on Linux. The OpenSSH developers released version 10.6p2 on November 5 with a critical security fix for Linux systems with the musl libc library, where sshd runs without PAM support. The cause lies outside sshd, but the flaw is exploited through it. Alpine Linux explains that, without PAM, sshd checks passwords with the crypt() function. The musl implementation returns the character “*” as an error indication when the password exceeds 256 bytes, and the same symbol is stored in accounts without a password, such as root in Alpine’s base image, so the check passes. The attacker sends a password of 257 to 1,024 bytes and logs in on the first attempt. The PasswordAuthentication setting must also be active, which is the default, and there must be another local account with a hashed password of type $5$ or $6$. Alpine versions 3.16 to 3.24 and the edge branch are affected. As mitigation, upgrading and restarting sshd is recommended or, temporarily, setting PasswordAuthentication no. Alpine does not consider systems with PAM enabled (UsePAM yes) or with locked accounts affected. When Alpine’s announcement was published no CVE number had been assigned, and CVE-2026-123158 comes from the KEV catalogue.

GPUStack and FreeSWITCH

GPUStack, an open-source platform for managing GPU clusters, presents the most multi-faceted problem. The project’s security advisory (score 9.8 out of 10) explains that all versions before 2.2.0, when the force_auth_localhost setting is disabled, as it is by default, treat every request that appears to come from the machine itself (loopback) as a request from the built-in administrator. For an external request to look local, a reverse proxy on the same machine or the forged header X-GPUStack-Real-IP: 127.0.0.1 is enough. The attacker can thus change users and models, create permanent administrator API keys, read worker-node credentials and cloud provider secrets and, through the POST /v2/inference-backends/from-yaml endpoint, execute code on the nodes. The advisory reports exploitation on an installation running version 2.1.1, where attackers created custom backends that opened reverse shells. The fix is 2.2.0 or, temporarily, setting force_auth_localhost=true and removing the header at the network edge.

In FreeSWITCH, SignalWire’s open-source VoIP telephony software, a single SIP MESSAGE is enough to execute a command on the server. The function that handles incoming messages splits the recipient’s name at the “+” symbol and sends the message to the corresponding “chat protocol.” The “api” protocol passes the content to FreeSWITCH’s API command execution mechanism. Versions up to and including 1.11.2 are affected with the default configuration and the problem is rated critical (9.8). The advisory, published on October 28, reports that exploitation has already been observed in practice and describes the impacts as operating-system command execution with the privileges of the FreeSWITCH process, disclosure of configuration and credentials, and full control of calls. Version 1.11.3 closes the path by default with the new parameter enable-chat-api-proto. Those who cannot upgrade can set enable-chat=false in profiles that do not need chat messages.

The new entries come a few days after the Apple and SonicWall vulnerabilities and the pair of Ivanti Connect Secure flaws that CISA added to the catalogue. For administrators, the sequence that follows from BOD 26-04 and the KEV guidance is clear: identify the systems exposed to the internet, upgrade and, where that is not feasible, apply the vendors’ temporary measures or stop using the product.