# sshole (CVE-2026-123158): The OpenSSH Flaw Hitting Alpine Linux and How to Fix It

By [Eoin Villarin](https://amvprosox.com/about). Published 2026-11-07. Canonical: https://amvprosox.com/blog/openssh-sshole-cve-2026-123158-alpine-linux

> An OpenSSH flaw called sshole lets attackers log in to password-less accounts on Alpine Linux and other musl-based systems, and it is already being exploited. Who is affected, how to check your servers and how to fix it.

## Am I affected by the sshole OpenSSH flaw?

You are at risk if a server runs OpenSSH older than 10.6p2 on a musl-based system such as Alpine Linux without PAM, allows SSH password logins, and has an account whose password field is only an asterisk next to another account with a real password hash. Debian, Ubuntu, Fedora and setups that use PAM are not affected.

**Key takeaways**

- CVE-2026-123158, called sshole, lets attackers log in to password-less accounts on musl-based Linux by sending an oversized password.
- Alpine Linux's default openssh-server package is affected, while glibc systems such as Ubuntu and setups using PAM are not.
- Attackers exploited it less than nine hours after it was published and gained root on a honeypot.
- The fix is OpenSSH 10.6p2 or Alpine's patched package for your branch, followed by an sshd restart.
- If you cannot update yet, set PasswordAuthentication no and use SSH keys.

A newly disclosed OpenSSH flaw called sshole, tracked as CVE-2026-123158, lets attackers log in to certain Linux accounts that are not supposed to accept passwords at all. It affects OpenSSH on musl-based systems such as Alpine Linux, it was fixed on November 5, 2026, and attackers started using it less than nine hours after it was published. If you run Alpine servers, Alpine-based Docker images with SSH, or small devices on OpenWrt, check them today.

## What is the sshole OpenSSH flaw?

On musl-based systems, the C library's crypt() function returns a single asterisk (*) when it fails to hash a password, for example when the password is longer than its 256-byte limit. Many Linux systems also use a single * in the password field to mean "this account has no password." OpenSSH compared the two, saw *, and treated it as a match. Sending an oversized password was enough to log in to a password-less account.

The behavior goes back to a 2016 change in OpenSSH's password handling. Security researcher Özgün Kültekin found it using AI agents that ran about 17,600 authentication tests. The CVE carries a CVSS 3.1 score of 8.1, which is rated High, and the fix shipped in OpenSSH 10.6p2.

## Am I affected?

A server is at risk when all of these are true:

- It runs OpenSSH older than 10.6p2 on a musl-based system, such as Alpine Linux, OpenWrt, Buildroot or Yocto.

- sshd does not use PAM. This is the default for Alpine's openssh-server package.

- SSH password logins are enabled, which is the OpenSSH default.

- At least one account has only * in its password field, such as a key-only user, next to another account with a real password hash.

Alpine's official AWS and Azure cloud images from 3.18.11 to 3.24.3 are a serious case: they include a default alpine user with no password and passwordless doas, which means a successful login can become root.

**Not affected:** glibc-based systems such as Debian, Ubuntu and Fedora, setups that check passwords through PAM, Dropbear, and OpenBSD. Accounts with a real password hash cannot be bypassed this way.

## How to check your servers

Run these as root on each Alpine server or container that runs sshd:

- Check the SSH settings: `sshd -T | grep -i -E 'passwordauthentication|usepam'`. If password authentication is off or PAM is on, this flaw cannot be used.

- Check the installed package: `apk list --installed | grep openssh`, and compare it with the fixed versions below.

- List accounts with no password: `awk -F: '$2=="*" {print $1}' /etc/shadow`.

- Look for logins to those accounts: `grep "Accepted password" /var/log/messages`. A password login to an account with * in its password field means the server was probably attacked.

## How to fix CVE-2026-123158 on Alpine Linux

Alpine shipped patched packages for every branch from 3.16 to edge on the same day as the disclosure. Update and restart sshd, because installing the update does not restart the running process:

`apk upgrade -U -a` and then `rc-service sshd restart`

| Alpine branch | Fixed openssh version |
| --- | --- |
| edge | 10.6_p2-r0 |
| 3.24 | 10.3_p1-r2 |
| 3.23 | 10.2_p1-r1 |
| 3.22 | 10.0_p1-r11 |
| 3.21 | 9.9_p2-r1 |
| 3.20 | 9.7_p1-r6 |
| 3.19 | 9.6_p1-r3 |
| 3.18 | 9.3_p2-r4 |
| 3.17 | 9.1_p1-r7 |
| 3.16 | 9.0_p1-r6 |

For Docker, rebuild every image that contains openssh from a fresh base image and redeploy it. Note that some SSH images on Docker Hub, such as linuxserver's openssh-server, turn password logins off by default but become exposed when PASSWORD_ACCESS=true is set.

Alpine releases older than 3.16 get no fixed package. Upgrade them to a supported release, or use the workaround below.

## Quick workaround: turn off SSH password logins

If you cannot update right away, set `PasswordAuthentication no` in /etc/ssh/sshd_config, restart sshd and run the sshd -T check again. Make sure your SSH key login works before you do this, or you can lock yourself out. Key-only SSH is a good default for any server anyway.

## What to do if you think you were hit

- Review doas usage, recently created users and every authorized_keys file.

- Check for unknown processes, cron jobs and outgoing connections.

- If you cannot rule out a compromise, treat the server as compromised: rebuild it from a clean image and rotate every password, key and token it held.

- Do not download proof-of-concept exploits from GitHub to test your servers. Researchers warn that some are unverified and may contain malware.

Keeping servers patched is a big part of the [website maintenance](https://amvprosox.com/website-maintenance) I do for clients. If you want a hand checking your hosting, Docker setup or SSH configuration, [get in touch](https://amvprosox.com/#contact-form).

## Frequently asked questions

### Is Ubuntu or Debian affected by sshole?

No. Debian, Ubuntu, Fedora and other glibc-based systems are not affected, and neither are setups that use PAM for password checks.

### Does key-only SSH protect me?

Yes. With PasswordAuthentication set to no, the server does not accept passwords, so the flaw cannot be used.

### Is CVE-2026-123158 being exploited?

Yes. Threat intelligence firm Previdian saw the first attempt less than nine hours after the CVE was published, and an attacker gained root on one of its honeypots running Alpine Linux.

### Which OpenSSH version fixes it?

OpenSSH 10.6p2. On Alpine, install the patched openssh package for your branch and restart sshd.

### Are Docker containers affected?

Containers based on Alpine that run sshd with password logins enabled can be affected. Rebuild them from an updated base image and redeploy.

### Do I need to restart after updating?

Yes. The running sshd keeps the vulnerable code in memory until you restart the service.

## Sources

- [BleepingComputer: OpenSSH flaw lets attackers log into password-disabled Linux accounts](https://www.bleepingcomputer.com/news/security/openssh-flaw-lets-attackers-log-into-password-disabled-linux-accounts/)

- [Help Net Security: OpenSSH flaw exploited in the wild hours after disclosure](https://www.helpnetsecurity.com/2026/11/06/openssh-sshole-cve-2026-123158-exploitation/)

- [Cycode: sshole OpenSSH password bypass on Alpine Linux](https://cycode.com/blog/sshole-cve-2026-123158-openssh-alpine-linux-vulnerability/)

- [Orca Security: sshole authentication bypass on Alpine Linux](https://orca.security/resources/research/sshole-openssh-authentication-bypass-gives-attackers-root-on-alpine-linux/)