HomeOctober 2026 patch cycleCVE-2026-123158 OpenSSH sshole: patch Alpine now
Call: Patch nowCategory: EnterpriseCategory: Homelabfrom 2026-10
CVE-2026-123158 OpenSSH sshole: patch Alpine now
Part of October 2026 patch cycle
- Vendor
- Linux
- Products
- OpenSSH before 10.6p2, Alpine Linux, OpenWrt, Buildroot, Yocto, and musl-based Docker images
- Published
- Status
- Open
Call: Patch now. OpenSSH before 10.6p2 on musl Linux without PAM lets a remote attacker log into accounts that have password login disabled (a * in /etc/shadow) by sending an oversized password. Previdian saw exploitation less than nine hours after disclosure on Nov 5, including a successful root login on an Alpine honeypot. CISA has not added it to KEV as of Nov 6. glibc distros (Debian, Ubuntu, Fedora) and anything that checks passwords through PAM are not affected.
What breaks: Nothing breaks. The bug is an authentication bypass. musl’s crypt() returns * when a password is longer than 256 bytes; OpenSSH’s 2016 timing fix for CVE-2016-6210 then treats that the same as the * stored for a password-disabled account, so the login succeeds. Accounts with real password hashes are not bypassed this way. Alpine’s default openssh-server package ships without PAM. Official Alpine AWS and Azure images ship a default alpine user with passwordless doas, which is effectively root if SSH password auth is on.
Who’s hit: OpenSSH on Alpine, OpenWrt, Buildroot, Yocto, and other musl systems with PAM off, password authentication on, at least one *-hash account, and another local account that has a real hash. Docker images based on Alpine with SSH exposed are in scope. Dropbear, OpenBSD, and glibc builds are out.
What to do:
- Upgrade to OpenSSH 10.6p2 (or your distro’s patched package) and restart sshd. Alpine pushed packages for 3.16 through edge the same day; installing without a restart leaves the old binary listening.
- Until you can patch: set
PasswordAuthentication noand restart sshd. - Hunt logs for
Accepted password foron accounts that should never take a password (alpine,root, key-only users). If you can’t rule a login out, treat the host as compromised.
Sources: BleepingComputer (opens in a new tab), The Hacker News (opens in a new tab), Help Net Security (opens in a new tab), NVD (opens in a new tab), GitHub Advisory (opens in a new tab).
Sources
- https://www.bleepingcomputer.com/news/security/openssh-flaw-lets-attackers-log-into-password-disabled-linux-accounts/ (opens in a new tab)
- https://thehackernews.com/2026/11/hackers-exploited-openssh-sshole-flaw.html (opens in a new tab)
- https://www.helpnetsecurity.com/2026/11/06/openssh-sshole-cve-2026-123158-exploitation/ (opens in a new tab)
- https://nvd.nist.gov/vuln/detail/cve-2026-123158 (opens in a new tab)
- https://github.com/advisories/GHSA-4fcc-vm97-gx3x (opens in a new tab)