OpenSSH SSHole Vulnerability CVE-2026-123158: CISA Lists the Login Bypass as Exploited, Which Linux Servers Are Exposed, and the Fixed Versions to Install

Attackers are now targeting a flaw in OpenSSH, the software used to log in to Linux servers remotely, that can open certain accounts with an overlong password instead of a real one. CISA added it, CVE-2026-123158, nicknamed SSHole, to its Known Exploited Vulnerabilities catalog on Monday, November 9, 2026, so anyone running Alpine Linux or another musl-based system with SSH reachable should treat this as this week's job.

The exposed setup is specific, and it can sit in places nobody checks first, such as containers, cloud images and embedded devices.

What is the OpenSSH SSHole vulnerability?

SSHole (also written *sshole or sshhole) is a password authentication bypass reported by Özgün Kültekin of Wakefield. OpenSSH addressed it in version 10.6p2 on Thursday, November 5, 2026, and called the release a critical security workaround.

An account with no password stores a * in its password field, meaning no password should ever match. On musl, the C library behind Alpine, the password function crypt() returns that same * when it fails on a key longer than 256 bytes. The two values match and the login is accepted. OpenSSH says the root cause is outside its own code but can be avoided there.

The trigger has a detail worth knowing. In StepSecurity's lab tests on a vulnerable Alpine 3.24 build, after a failed first attempt in the same connection, a 256-byte password was rejected and a 257-byte password was accepted. A 300-byte password sent as the very first attempt was rejected. Alpine's advisory describes one connection with no retries and a range of 257 to 1,024 bytes. StepSecurity warns that scanners sending one long password per connection can report vulnerable hosts as safe.

Is SSHole being exploited? What is confirmed and what is not

Confirmed

• CISA's catalog lists CVE-2026-123158 as of November 9, with a due date of Thursday, November 12. That deadline binds US federal civilian agencies, not private companies, but CISA says organizations should use the catalog to help set patching priorities.
• The SANS Internet Storm Center recorded what it calls the first actual exploit attempt on November 5, using a password of repeated "A" characters.
• SANS honeypots logged long SSH passwords 232 times on November 5, 713 on November 6, 246 on November 7 and 51 on November 8, the day the diary was published.

Not confirmed

• Successful break-ins at real organizations. The SANS diary reports none. Its author expects some logins succeeded against the honeypots themselves and promised details, which says nothing yet about real victims.
• What the counts mean. They are long-password requests, not compromised servers, and the honeypots record only the first 255 characters of a password.

Not known

• Who has been hit, or how many servers are exposed. No source we opened names a victim, and CISA lists ransomware use as Unknown.

Which Linux servers are affected by SSHole?

Alpine says you are exposed only if all of these are true:

• You run Alpine's openssh-server package, which is built without PAM (the optional login framework), or openssh-server-pam with UsePAM no
• PasswordAuthentication is yes, which is the default
• An account has * as its password field, such as key-only users, directory users from nslcd, winbind or sssd, or the alpine user in cloud images
• At least one local account has a real $5$ or $6$ password hash

The researcher also names OpenWrt, Buildroot and Yocto as musl-based. StepSecurity narrows that to OpenWrt with OpenSSH rather than its default Dropbear, and Yocto built with musl. The researcher says glibc, PAM, Dropbear and OpenBSD systems are not affected. Alpine also rules out accounts locked with !.

Can an attacker reach root? A root password login needs PermitRootLogin yes, which is not the default. But another account that can log in and escalate through doas can also reach root. Official tiny-cloud Alpine images from 3.18.11 through 3.24.3 ship an alpine user with a * password and passwordless doas. Alpine says those images are safe on first boot and become exploitable once any $6$ hash exists on the machine.

OpenSSH SSHole fixed versions

Images built from Alpine 3.21.10, 3.22.8, 3.23.8, 3.24.4 and later include the fix. Instances already running from older images still need the update.

Do not judge by the version banner. StepSecurity found a patched 10.3_p1-r2 host still reporting OpenSSH_10.3p1, which is why a community check script flagged it as exposed. We covered this trap in Updated Is Not the Same as Patched.

How to fix SSHole: what to do this week

1. List every musl-based system running sshd. Include Alpine servers, containers with SSH, cloud images, CI runners and any device built on OpenWrt, Buildroot or Yocto.
2. Update, using Alpine's command. Run apk upgrade -U -a. It upgrades the whole system, not only OpenSSH, so plan for that.
3. Restart the service. Run rc-service sshd restart. Alpine notes that upgrading the package does not restart a running sshd.
4. Confirm the package revision. Run apk info -v openssh-server (or openssh-server-pam) and compare it with the table, rather than relying on sshd -V.
5. If you cannot update yet, turn off password logins. Set PasswordAuthentication no using the steps in Alpine's advisory, after confirming key login works and with your current session still open. Then run sshd -T | grep -i passwordauthentication, which should print passwordauthentication no.
6. Rebuild images. StepSecurity says exposure now sits mainly in images built or pinned before November 5, including cached CI layers and internal registry copies.
7. Check for break-ins. Run grep "Accepted password for" /var/log/messages and look for alpine, root or any key-only user. Review doas use, new users, new files and authorized keys. If you cannot rule out a login, Alpine says to treat the host as compromised.

Why SSHole matters for a business network

Key-only accounts are the setup most administrators consider the safe one, and this flaw turns that assumption around: the account with no password is the one that opens. An SSH service on an internet-facing host or a forgotten container can become a foothold on the rest of the network.

CISA's entry also calls for forensic triage and for assessing each asset's internet exposure. Those are federal requirements, but they are good practice anywhere, because the update closes the hole without telling you whether someone came through it first. If a vendor or an old contractor built your systems, this is the moment to find out who is patching the software that runs your business.

OpenSSH SSHole questions people are asking

Is SSHole being actively exploited?

CISA lists it as known exploited, and SANS honeypots recorded attempts from November 5. No source we opened confirms a named victim or a count of compromised servers.

What is CVE-2026-123158?

It is the identifier for SSHole. Alpine's November 5 advisory had no CVE number at the time of writing, and CISA's catalog now lists this one.

Does SSHole affect Ubuntu or other glibc Linux servers?

The researcher says glibc systems are not affected, and StepSecurity says the same of GitHub-hosted Ubuntu runners and glibc-based self-hosted runners.

Does any long password work on the first try?

Not in StepSecurity's tests, where a failed attempt had to come first in the same connection. Alpine's advisory describes it as needing no retries, so do not rely on the difference.

Does turning off password login stop SSHole?

Yes. Alpine lists PasswordAuthentication no as not affected. It is a stopgap until the update is in.

Do I need to restart after updating OpenSSH?

Yes. The old daemon keeps running until sshd is restarted.

The bigger lesson

This flaw came from behaviors that sat unnoticed for over a decade, and a setting that looked safe was the way in. Knowing what runs on your network, down to the C library inside a container, is what makes a Monday catalog entry a quick job rather than a long investigation.

For help with this, see our security hardening service or request a quote.

Get security alerts by email, with the free checklist, at our security alerts page.

Sources: OpenSSH release notes; Alpine Linux advisory; researcher's disclosure; StepSecurity analysis; SANS Internet Storm Center diary; CISA KEV catalog; CISA BOD 26-04.