SSHole OpenSSH Flaw (CVE-2026-123158): How to Check and Patch Alpine Servers

The SSHole OpenSSH flaw (CVE-2026-123158) lets an attacker log in to some Linux servers by sending an overlong password, without knowing the real one. It affects OpenSSH before 10.6p2 on systems that use the musl C library with PAM switched off, which is the default on Alpine Linux. Attacks have already been seen, so if you run Alpine servers, containers or other musl-based devices with SSH open, patch and restart sshd today.

Quick summary

• What: a password-authentication bypass in OpenSSH’s sshd on Linux systems that use musl libc without PAM.
• Severity: CVSS 3.1 score 8.1 (High), according to the Alpine/OSV record and Germany’s BSI.
• Fixed in: OpenSSH 10.6p2, released on 5 November 2026, plus patched Alpine packages for branches 3.16 to 3.24.
• Exploited: GreyNoise says it first saw successful exploitation on 7 November 2026, and activity continued on 8 November.
• Not affected (reportedly): glibc distributions such as Debian, Ubuntu and Fedora, PAM-based setups and the Dropbear SSH server.

What is the SSHole OpenSSH flaw?

The OpenSSH team describes the fix in 10.6p2 as a “critical security workaround” for Linux systems that use the musl libc with PAM disabled. It says the root cause lies outside sshd, but can be triggered through it. So OpenSSH now avoids the problem itself, without waiting for a library fix.

Also read: Zyxel GS1900 Vulnerability: Install Patch 3 Now to Stop Root Attacks

The Alpine record on OSV explains the result in plain terms: for some account configurations, any password between 256 and 1024 characters succeeds. The bug comes from sshd misreading whether a string is a real password hash. Germany’s BSI rates it high (8.1) and notes that a public proof-of-concept exists.

Which systems are affected?

An attack only works when several conditions line up. According to the researcher’s write-up and the advisories, a server is at risk when all of these are true:

• It runs OpenSSH older than 10.6p2 on Linux built with musl libc (Alpine Linux is the best-known example).
• OpenSSH is used without PAM. Alpine’s default openssh-server package fits this.
• Password logins are enabled (PasswordAuthentication yes, the OpenSSH default).
• There is at least one account whose password field in /etc/shadow is * (no usable password), plus another account with a real password hash.

Reports say root has shipped with * on Alpine since about version 3.16, although the default PermitRootLogin setting usually blocks password logins for root. Reports also say some official Alpine cloud images carry a default passwordless “alpine” user. Other musl-based builds, such as some OpenWrt, Buildroot and Yocto images and slim Docker images, are worth checking too, but none of these is confirmed as vulnerable by default.

Setup	At risk?
Alpine Linux with stock openssh-server, password logins on	Yes, until patched and restarted
Docker image built on Alpine that runs sshd	Yes, if it allows password logins
Other musl-based firmware (OpenWrt, Buildroot, Yocto)	Check: depends on SSH server, PAM and libc
Debian, Ubuntu, Fedora, RHEL (glibc)	Reportedly not affected
OpenSSH with UsePAM yes	Reportedly not affected
Dropbear SSH server	Reportedly not affected

Is SSHole being exploited?

Yes. GreyNoise, which runs sensors that watch internet scanning, began tracking SSHole activity on 5 November 2026. It logged the first public exploit that same day and the first successful exploitation at 00:46 UTC on 7 November. By its last update on 8 November, it had confirmed six attacker IP addresses in post-exploitation activity, with new ones still appearing.

Most of the traffic GreyNoise saw was mass scanning of port 22. Only a small share were real exploitation attempts. But a single successful login on a passwordless account can be enough to take over a box. For Indian startups and MSMEs that run Alpine containers on cloud VMs, that is a real risk.

How to check and fix the SSHole OpenSSH flaw

These steps are for Alpine Linux. On other musl systems, use that system’s own package manager. Run them as root, and keep a second session open in case you lock yourself out.

1. Confirm the C library and release. Run ldd --version. musl prints a line starting with “musl libc”. On Alpine, cat /etc/alpine-release shows the branch.
2. Check how sshd is set up. Run sshd -T | grep -Ei "passwordauthentication|usepam". If password authentication is yes and UsePAM is no, you match the risky setup.
3. Find accounts with no usable password. Run awk -F: '$2=="*"{print $1}' /etc/shadow to list them.
4. Upgrade OpenSSH. Run apk update && apk upgrade openssh, then compare the installed version with the table below.
5. Restart sshd. Run rc-service sshd restart. Until you restart, the old sshd keeps running and keeps accepting the attack.
6. Turn off password logins if you can. Set PasswordAuthentication no in /etc/ssh/sshd_config and restart sshd again. Check that key-based login works first.

# Alpine quick check and patch (run as root)
ldd --version 2>&1 | head -1
cat /etc/alpine-release
sshd -T | grep -Ei "passwordauthentication|usepam"
awk -F: '$2=="*"{print $1}' /etc/shadow
apk update && apk upgrade openssh
rc-service sshd restart

Fixed openssh package by Alpine branch (from the Alpine record on OSV):

Alpine branch	Fixed openssh version
3.24	10.3_p1-r2
3.23	10.2_p1-r1
3.22	10.0_p1-r11
3.21	9.9_p2-r1
3.20	9.7_p1-r6
3.19	9.6_p1-r3
3.18	9.3_p2-r4
3.17	9.1_p1-r7
3.16	9.0_p1-r6

Containers need one extra step. Rebuild every image from an updated Alpine base and redeploy it, because running containers keep the old package. If you build OpenSSH from source, move to 10.6p2 or later.

How to tell if a server was already broken into

If an exposed server ran a vulnerable build with password logins on after 5 November, check it before you trust it again:

• Search the logs for password logins, for example grep "Accepted password" /var/log/messages. Look closely at accounts that should never log in with a password.
• Look for new users, changed authorized_keys files, new cron jobs and unexpected doas or sudo use.
• If you cannot rule out a login, treat the server as compromised. Rebuild it from a clean image, rotate its keys and secrets, and restore data from a known-good backup.

A tested, offline copy of your data makes that rebuild far less painful. See our guide to backup solutions for businesses. Teams without in-house security staff can also look at managed cybersecurity services for patching and monitoring.

This is the latest in a run of server-side flaws that attackers moved on quickly, after PHP2Shell in PHP, the Xen XSA-523 VM escape bugs and ransomware attacks on Synology NAS boxes.

Frequently asked questions

Does SSHole affect Ubuntu or Debian servers?

Reportedly not. Debian, Ubuntu and Fedora use glibc rather than musl, and the bypass needs musl libc with PAM disabled. Updating OpenSSH from your distribution’s normal channel is still good practice.

What is the CVE number for SSHole?

SSHole is tracked as CVE-2026-123158. The Alpine record on OSV and Germany’s BSI both score it 8.1 (High) on CVSS 3.1.

Is upgrading the package enough?

No. You also need to restart sshd (rc-service sshd restart on Alpine), because the old process keeps running until then. Containers must be rebuilt from an updated base image.

What can I do if I cannot patch right away?

Set PasswordAuthentication no and use SSH keys only, or stop SSH or block port 22 from the internet until you can patch. Limit SSH access to known IP addresses or a VPN.

Bottom line

SSHole only hits a specific setup: musl libc, no PAM, and password logins on. But that setup is the default on Alpine, which runs a huge number of containers and cloud servers. It is already being exploited. Upgrade OpenSSH, restart sshd, switch to key-only logins, and check exposed servers for unexpected password logins.

Sources

• Portable OpenSSH 10.6p2 release announcement (oss-security, 5 November 2026)
• ALPINE-CVE-2026-123158: Alpine Linux fixed versions (OSV)
• BSI cybersecurity warning on CVE-2026-123158 (PDF, German)
• GreyNoise: SSHole (CVE-2026-123158) activity tracker

About The Author