CVE-2026-123158 (*sshole)

TLDR;

• Affected: OpenSSH sshd before 10.6p2 on Linux systems that use musl libc without PAM, such as Alpine Linux.
• Severity: High, CVSS v3.1 score 8.1.
• Exploitation: Successful root access detected on an Alpine honeypot by various vendors.
• Action: Upgrade to OpenSSH 10.6p2 or the distribution package, then restart sshd.
• Interim step: Set PasswordAuthentication to no and review logs for unexpected password logins.

OpenSSH is the most widely used implementation of the SSH protocol for remote login. CVE-2026-123158, named *sshole, was published on November 5, 2026, with a CVSS v3.1 score of 8.1 (High). An unauthenticated attacker with network access to the SSH port can log in to an account that has no usable password by sending an overlong password.

Access carries the permissions of that account. Exposure applies to Linux systems built on musl libc with PAM disabled, including Alpine Linux, OpenWrt, Buildroot and Yocto. OpenSSH released version 10.6p2 on the same day. OpenSSH credits researcher Özgün Kültekin of Wakefield with the discovery in its 10.6p2 release notes.

Technical Details of 2026-123158 (*sshole)

The CVE record states that sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass. For some account configurations, a password of 257 to 1024 bytes succeeds (the length window Kültekin describes on sshhole.com). The CVE record phrases the same range as “256 to 1024 characters.”

Without PAM, sshd verifies a password by hashing it with the C library’s crypt function. On musl, crypt returns "*" when hashing fails, which happens for passwords longer than 256 bytes. Accounts without a usable password store "*" in the password field, so the failed hash matches the stored value and the login succeeds.

Kültekin traces the behavior to the 2016 fix for CVE-2016-6210, which made sshd hash a dummy password for accounts with no usable hash to close a username-timing side channel. On musl, that dummy hash now returns "*" and matches the "*" placeholder in shadow.

Alpine states that an attacker who can reach the SSH port can log in without a password in a single connection when the conditions are met. Those conditions are: password authentication enabled, at least one account with "*" as its password field, and at least one other account with a $5$ or $6$ hash.

The CWE is CWE-394 (Unexpected Status Code or Return Value). The CVSS v3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected Products or Versions

The affected product is the OpenSSH server (sshd) on Linux. The CVE record lists all versions before 10.6p2, and practical exposure requires musl libc, PAM disabled, and the account conditions above.

• Affected: OpenSSH before 10.6p2 on musl-based Linux without PAM (Alpine, OpenWrt, Buildroot, Yocto).
• Fixed: OpenSSH 10.6p2, and Alpine packages such as edge 10.6_p2-r0 and point releases 3.21.10, 3.22.8, 3.23.8 and 3.24.4.
• Not affected: glibc-based distributions, systems that use PAM, non-Linux systems, and Dropbear.
• Alpine cloud images: per the Alpine Linux advisory, tiny-cloud images from 3.18.11 through 3.24.3 ship an alpine user with passwordless doas. The images are safe at first boot and become exploitable once any $6$ hash exists on the host, for example when an admin sets a console password.

Detecting CVE 2026-123158 (*sshole)

Check the OpenSSH version, the libc, and the SSH configuration first, then review authentication logs for password logins on accounts that should not accept passwords. Alpine advises treating a host as compromised when a login cannot be ruled out.

• Confirm sshd version, musl libc, PAM status, and the PasswordAuthentication setting.
• Check /etc/shadow for accounts with "*" as the password field.
• On Alpine, search /var/log/messages for “Accepted password for” entries tied to accounts such as alpine, root or key-only users.
• Review doas usage, recently created users and files, and authorized_keys entries.
• Previdian reports short non-interactive sessions running id, uname and hostname against its honeypot.
• Reported source IP : 89.116.89[.]18.

Every fortnight our security engineers update DAST vulnerability scanner’s test cases. So we’re always one step ahead.

Get started at $7!

Mitigation of CVE 2026-123158 (*sshole)

Upgrade to OpenSSH 10.6p2 or the patched package from your distribution. On Alpine, run apk upgrade openssh. Upgrading the package does not restart a running sshd, so restart the service after patching.

1. Patch or rebuild affected images and appliances.
2. Restart sshd and confirm the new version.
3. Review the logs and accounts listed under Detection.

The Alpine Linux advisory lists fixed packages for every release from 3.16 through 3.24, so older branches also have a patched package.

The CVE was not in the CISA KEV catalog (version 2026.11.04), so no KEV due date applies.

Workaround for CVE 2026-123158 (*sshole)

Alpine and several reference sources advise disabling password logins until the patch is applied. The remaining bullets are general measures and are not vendor guidance.

• Set PasswordAuthentication to no in sshd_config and restart sshd. Confirm key-based login works in a second session first.
• Check for signs of exploitation and IOCs in logs, EDR, and network telemetry.
• Take affected assets off the internet, or cut them off from the internet until patched.
• Restrict SSH access to trusted IP ranges, a VPN, or an internal network.
• Segment affected hosts and increase monitoring on them.

Not sure if this CVE affects you?

→ Talk to an Astra expert

References

Primary sources first, then secondary coverage and telemetry.

• OpenSSH 10.6p2 release notes.
• Alpine Linux advisory, openssh-server password authentication bypass, 5 Nov 2026.
• sshhole.com Özgün Kültekin’s write-up.
• CVE record, CVE-2026-123158.