OpenSSH SSHole bypass hits Alpine; fix out, attacks seen
First merged summary.
OpenSSH 10.6p2 fixes a musl password-authentication bypass on Alpine; later reports say attackers reached honeypots.
A password-authentication bypass can let a remote attacker log into certain Alpine Linux SSH servers when musl libc is used, PAM is disabled, and an account stores * in its password field. OpenSSH shipped portable 10.6p2 on November 5; Alpine published point releases and backports, and administrators must restart sshd. Later outlets assign CVE-2026-123158 and report exploitation within hours, including a successful root login on an Alpine honeypot. Cyber Security News says another local account must hold a $5$ or $6$ hash; other outlets describe any 257–1024-character password as sufficient. DataBreaches reported no confirmed attacks, while Help Net Security and The Hacker News cited Previdian’s honeypot hit the same day.
- Passwords of 257 to 1024 characters are the reported bypass method.
- Alpine fixes include 3.21.10, 3.22.8, 3.23.8 and 3.24.4.
- SecurityWeek and Horizon3 cite CVSS 8.1; The Hacker News says OpenSSH rated it critical.
- Tiny-cloud images from Alpine 3.18.11 through 3.24.3 can be affected.
- PasswordAuthentication no, or UsePAM yes, is not affected.
- Özgün Kültekin of Wakefield reported the issue and dubbed it sshole.
Timeline
dated events in the reporting · oldest first- Nov 5, 2026OpenSSH 10.6p2 released as the workaround · Help Net Security
- Nov 6, 2026Exploitation first observed, including an Alpine honeypot root login · SecurityWeek
- Nov 7, 2026GreyNoise recorded successful exploitation chains · BleepingComputer
What each outlet adds
beyond the shared facts- Cyber Security NewsNames Alpine point releases and an extra $5$ or $6$ hash condition.
- Help Net SecurityPrevidian honeypot root login; CISA has not added it to KEV.
- DataBreaches.netCites OpenWrt, routers, IoT and over 30 million weekly Docker downloads.
- Horizon3.aiLists Alpine edge and 3.24 backport package versions.
- BleepingComputerGreyNoise chains, a failed TAC Agent install, and Defused’s limited activity.
- CVEs
- CVE-2026-123158
- Countries
- Japan
Coverage
oldest first · one row per article · UTC- · 4d ago
Hacker News · securityFirst report
Alpine OpenSSH bypass lets attackers log in without the password
A reachable sshd built without PAM accepts one 257-to-1024-byte password for accounts whose shadow field is *.
- · 4d ago
Cyber Security News
OpenSSH password bypass affects Alpine servers using musl without PAM
Portable OpenSSH 10.6p2 adds a workaround; Alpine fixes include 3.21.10, 3.22.8, 3.23.8 and 3.24.4, with no CVE assigned.
- · 4d ago
The Hacker News
OpenSSH 10.6p2 fixes long password bypass on Alpine Linux SSH
Long passwords bypass SSH authentication for passwordless accounts on Alpine Linux; OpenSSH 10.6p2 and Alpine updates released.
- · 3d ago
BleepingComputer
OpenSSH flaw lets attackers log into password-disabled Linux accounts
Attackers can log into accounts with asterisk password hashes on musl-based systems by submitting oversized passwords; fixed in OpenSSH 10.6p2.
- · 3d ago
The Register · Security
OpenSSH fixed for *sshole long-password root flaw on musl systems
Attackers can gain root on musl libc OpenSSH by supplying 257-1024 character passwords when no PAM is used.
- · 3d ago
Ars Technica · Security
Alpine Linux SSH lets attackers log in without password via *sshole
Alpine Linux and other distributions using OpenSSH with musl without PAM allow passwordless SSH access when SHA256 or SHA512 hashes and passwordless accounts are configured.
- · 3d ago
CSO Online
OpenSSH flaw allows access to password-disabled accounts on musl Linux
Attackers bypass authentication on Alpine Linux cloud images by sending long passwords; emergency fix in OpenSSH 10.6p2.
- · 3d ago
GBHackers
OpenSSH sshole Flaw Allows Login to Passwordless Accounts
OpenSSH sshole flaw lets attackers log into password-disabled accounts using 257-1024 character passwords on musl-based systems.
- · 3d ago
SOCRadar
OpenSSH password bypass fixed on Alpine Linux
A password bypass vulnerability in OpenSSH on Alpine Linux has been addressed in a security update.
- · 3d ago
SecurityWeek
OpenSSH Patches SSHole Authentication Bypass
CVE-2026-123158 lets attackers log in with passwords 257-1024 characters on Alpine Linux without PAM.
- · 3d ago
Help Net Security
OpenSSH sshole flaw exploited in the wild hours after disclosure (CVE-2026-123158)
Previdian detected successful root access on an Alpine Linux honeypot within hours of disclosure.
- · 3d ago
DataBreaches.net
Long passwords bypass SSH on musl-based Alpine and OpenWrt
Researcher Özgün Kültekin dubbed the decade-old bug sshole; emergency updates exist, with no attacks confirmed here.
- · 3d ago
Hackers Exploit OpenSSH SSHole Flaw Within Hours of Disclosure
Attackers gain root access on Alpine Linux honeypot via CVE-2026-123158; patch released in OpenSSH 10.6p2
- · 2d ago
Horizon3.ai
CVE-2026-123158: OpenSSH musl auth bypass enables RCE
Exploitation confirmed in the wild for musl-based OpenSSH before 10.6p2; fixed in 10.6p2 with Alpine backports.
- · 1d ago
Lobsters · security
Musl libc '*' sentinel enables unauthenticated shell on Alpine sshd
Unauthenticated users gain shell access on musl-based Alpine AWS images due to crypt function behavior and sshd handling.
- · 4h ago
Hackers Exploit SSHole Authentication Bypass in OpenSSH (CVE-2026-123158)
Attackers supply any password 257-1024 characters long to bypass authentication on Alpine and musl-based Linux systems.
- · 40m ago
Attackers exploit OpenSSH SSHole auth bypass on musl Linux (CVE-2026-123158)
GreyNoise logged 16 successful chains from six IPs after the 10.6p2 fix; one install of TAC Agent never reached its C2.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-123158 | Password bypass in OpenSSH before 10.6p2 on musl without PAM | 8.1 | 1% | PoC ×13 |