OpenSSH sshole Vulnerability CVE-2026-123158: Exploited Login Bypass on Alpine Linux, What Is Confirmed and the Fixed Versions to Install

A flaw in OpenSSH, the remote login software used to manage Linux servers, can let an attacker log in without a valid password on Alpine Linux and other systems built on the musl C library without PAM. CISA listed it as exploited on Monday, November 9, 2026, so if your company runs Alpine with SSH reachable from the internet, or runs anything built on it, this is a job for this week.

The bug is tracked as CVE-2026-123158 and nicknamed sshole (also written SSHole). It is narrow: it needs a specific build and specific account settings, and Red Hat says its products are not affected.

What is the OpenSSH sshole vulnerability?

On Thursday, November 5, 2026, the OpenSSH project released portable OpenSSH 10.6p2 with what it called a critical security workaround for a password authentication bypass. The CVE record, published the same day, scores it 8.1 (High) and covers OpenSSH before 10.6p2 on Linux. The project credits Özgün Kültekin of Wakefield and says the root cause sits outside sshd but can be avoided there.

Alpine's advisory explains the mechanism. Without PAM, sshd checks a password by hashing the attempt with crypt() and comparing the result to the stored password field. On musl, crypt() returns a single * as an error when the password is too long. Passwordless accounts also store *. The two match, and the login succeeds. The attacker needs a username and a password of 257 to 1,024 bytes, and at least one other local account must have a real $5$ or $6$ password hash.

Is CVE-2026-123158 being exploited?

Confirmed:

• CISA's catalog added it on November 9, with a November 12 due date for federal agencies and a forensic triage requirement under BOD 26-04. Ransomware use is listed as unknown.
• The SANS Internet Storm Center saw long passwords at its honeypots peak at 713 on November 6, with the first attempts tied to this flaw on November 5. Those are counts of long-password attempts, not break-ins.
• Previdian's sensors logged 20 attempts from 13 IP addresses in 9 countries between November 6 and 8.

Claimed, but not confirmed in the data we could open:

• The Hacker News reported that Previdian confirmed root access on an Alpine honeypot. Previdian's public data page does not say that. It states its sensor data does not show that the target was vulnerable or that the attempt succeeded.
• SANS handler Johannes Ullrich wrote that he expects quite a few attempts succeeded against the honeypots and promised more detail. That is an expectation, not yet a finding.
• The same news report puts the first attempt less than nine hours after the CVE was published. Previdian's page gives two different first-seen times on November 6 and does not reconcile them. SANS dates the first attempts to November 5.

Not known: no source we opened names a victim or counts compromised real-world servers.

Is my server vulnerable to sshole?

Per Alpine, you are affected only if all of these are true:

• You run the openssh-server package (built without PAM), or openssh-server-pam with UsePAM no.
• PasswordAuthentication is yes, which is the OpenSSH default.
• At least one account has * as its password field. That can be root, key-only users, directory-service users served through musl-nscd, or the alpine user in official tiny-cloud images.
• At least one local account has a $5$ or $6$ hash.

Alpine lists these as not affected: containers that do not run sshd, systems with PasswordAuthentication no, openssh-server-pam with UsePAM yes, accounts locked with !, and cloud images configured by cloud-init.

One group deserves a close look. Official tiny-cloud images from 3.18.11 through 3.24.3 include an alpine user with a * password and passwordless doas. They are safe at first boot, but become exploitable once any $6$ hash exists on the system, and an attacker can then reach root.

OpenSSH fixed versions for Alpine Linux

Alpine backported the fix, so a version number below 10.6p2 can still be patched. These are the fixed openssh packages from its advisory:

Official images built from 3.21.10, 3.22.8, 3.23.8, 3.24.4 and later include the fix. Earlier images do not, so running instances still need updating.

What to do this week

1. List your exposure. Find every host with SSH reachable from the internet, including vendor appliances and images. Ask vendors in writing whether their product uses musl and sshd without PAM.
2. Check the package. On Alpine, run apk list -I openssh and compare with the table above.
3. Update and restart. Run apk upgrade -U -a, then rc-service sshd restart. Alpine warns that a running daemon keeps the old code until it restarts.
4. If you cannot patch yet, turn off password login. Confirm key login works and keep your current session open while you test. Follow the steps in Alpine's advisory, then confirm that sshd -T | grep -i passwordauthentication shows passwordauthentication no.
5. Look for signs of use. Check /var/log/messages for sshd accepting a password for an account that has none, such as alpine, root or a key-only user. Review doas use, recently created users, changed files and new authorized_keys entries.
6. Assume the worst if unsure. Alpine says that if you cannot rule out a login, treat the host as compromised. Our advice: rebuild it from a known-good image and rotate every key and password it held.

Why this matters for a company network or website

Nobody on your team may have chosen Alpine. CISA's entry notes the flaw affects an open-source component that other products may use, so appliances and images built on Alpine can carry it. Whoever gets in holds that account's access, including anything stored on that server.

Expect noise from scanners too. A tool that only compares version numbers can flag a patched Alpine package, or a Debian server that does not fit the conditions. Check the conditions on the machine itself rather than trusting the alert or dismissing it.

Client settings are another trap. A discussion in the Coolify project points out that a management tool connecting with keys does not stop the server from accepting passwords from everyone else. Its author calls this a configuration gap and says exploitation of Coolify has not been demonstrated. The point applies to any tool that manages your servers. If you run your own, our self-hosting infrastructure page covers how we approach it.

OpenSSH sshole questions people are asking

Does sshole give attackers root access?

Not automatically. An attacker gets the account they logged in as. Alpine base images ship root:*, but root is reachable only with PermitRootLogin yes or if another login account can become root, for example through doas.

Do I need OpenSSH 10.6p2 exactly?

Not on Alpine. Install the fixed package for your branch. Builds from source need 10.6p2.

Are Ubuntu, Debian or Red Hat affected?

The flaw requires musl without PAM. Red Hat says it is not affected. Ubuntu's note says it should not be, though its status still reads "Needs evaluation". Debian's tracker lists stable releases as vulnerable at "unimportant" urgency.

Are Docker containers affected?

Alpine says containers that do not run sshd are not affected. A container that runs sshd and meets the conditions above is.

Will a strong password protect me?

No. The attack targets accounts with no password, and Alpine notes that one account with a real password is enough to expose every passwordless account. Turning off password login does protect you.

Do I have to restart after updating?

Yes. Until sshd restarts, the old code keeps running.

The bigger lesson

This login check failed because an error value from a C library happened to match a placeholder in a password file, on a setting left at its default. You cannot predict that kind of interaction, but you can turn off the login methods you do not use. OpenSSH also says in these release notes that it will ship more often for now because bugs found with AI are being independently rediscovered, so the time you have to patch is not getting longer. Patch, restart, then verify what is actually running.

For help locking down your servers, see security hardening or request a quote.

Get security alerts by email, with the free checklist, at /security-alerts.

Sources: OpenSSH 10.6p2 release notes; Alpine Linux advisory; CVE record; CISA Known Exploited Vulnerabilities catalog; SANS Internet Storm Center; Previdian; Red Hat; Ubuntu; Debian.