Thinking Thinking

News

The sshole OpenSSH flaw was exploited within hours of its fix

CVE-2026-123158 let an oversized password bypass authentication on Alpine Linux and other musl systems without PAM, and attackers were using it the same week it was patched on 5 November 2026.

By Thinking Desk Updated 2 min read

Key takeaways

  • OpenSSH 10.6p2, released on 5 November 2026, fixed a password authentication bypass affecting Linux systems using musl libc without PAM.
  • Alpine's tracker states that for some account configurations any password between 256 and 1024 characters succeeds.
  • Alpine Linux, OpenWrt, Buildroot and Yocto are the affected families, which puts a very large number of container base images in scope.
  • Exploitation attempts were reported within hours of disclosure, and the first confirmed successful exploitation on 7 November.
On this page
  1. What is the sshole OpenSSH flaw?
  2. Which systems are affected by CVE-2026-123158?
  3. How fast was it exploited?
  4. What it means for a small or mid-sized European operator

What is the sshole OpenSSH flaw?

A password long enough to break a library function let attackers log in to some Linux accounts without a valid password. CVE-2026-123158, nicknamed sshole by the researcher who found it, Özgün Kültekin, was fixed in OpenSSH 10.6p2 on 5 November 2026. Alpine's security tracker describes it precisely: sshd before 10.6p2 on Linux, "when musl libc is used without PAM, lacks a workaround for a password authentication bypass", and "for some configurations of accounts, any password between 256 and 1024 characters succeeds."

The mechanism is a misread error value. As BleepingComputer put it, an oversized password makes musl's password hashing function return an asterisk on error, and OpenSSH treats that asterisk as a match. Accounts whose stored hash is an asterisk, which is how many distributions mark an account as having no usable password, therefore accept the oversized password.

Which systems are affected by CVE-2026-123158?

Only Linux systems using musl libc without PAM, which in practice means Alpine Linux and the embedded build systems OpenWrt, Buildroot and Yocto. That is a narrow description with a wide blast radius, because Alpine is the default base image for a very large share of container workloads and appliance firmware.

Alpine published fixes across its branches on the day of disclosure: 10.6_p2-r0 on edge, 10.3_p1-r2 on 3.24, 10.2_p1-r1 on 3.23, 10.0_p1-r11 on 3.22, 9.9_p2-r1 on 3.21, 9.7_p1-r6 on 3.20 and 9.7_p2-r5 on 3.19.

Weekly, Thursday morning, Central European Time.

The Thinking briefing

One email a week: what changed in European business software, which prices moved, and which comparison we published. No sales mail.

We store your address to send the briefing. One click unsubscribes you, and we never pass it on.

How fast was it exploited?

Within hours, and accounts of the timeline differ slightly. Help Net Security reported a first exploitation attempt detected less than nine hours after CVE publication, with threat intelligence firm Previdian confirming root access on its Alpine honeypot and recording eight attempts from a single Japan-based address. BleepingComputer reported a proof of concept roughly four hours after the patch, attempts from 5 November, and the first successful exploitation on 7 November, citing GreyNoise for 16 successful chains from six addresses about 40 hours after the fix, Previdian for 20 attempts from 13 addresses across nine countries, and watchTower for activity tied to botnets and cryptomining. Defused described a small number of actors.

What it means for a small or mid-sized European operator

If you run anything self-hosted, you probably run Alpine without knowing it, because it is inside containers your supplier built. Three actions. Patch and then restart sshd, because the running binary keeps the old code until it is restarted, a step that is easy to skip on an appliance. Set PasswordAuthentication to no on anything reachable from the internet, which closes this class of bug permanently and costs nothing if you already use keys. Then search your logs for successful password logins on accounts that are not supposed to have a password, and check authorized_keys files and newly created users before you call it clean. For small firms, the practical lesson is that key hygiene beats password hygiene on servers, which is also the dividing line we use in /en/best/best-password-managers-2026, and if containers reach your estate through a build pipeline, the tooling choices in /en/best/best-ai-coding-tools-2026 decide how quickly a base image gets rebuilt.

Questions and answers

Am I affected if I run Debian or Ubuntu?
No. The bypass needs musl libc without PAM, which rules out glibc-based distributions such as Debian, Ubuntu, RHEL and their derivatives. The risk sits in Alpine-based containers and embedded images, which many businesses run without realising it.
Is patching enough?
Patch, then restart sshd, because the running process keeps the vulnerable code until it is restarted. After that, disable SSH password authentication where you can and review logs for successful password logins on accounts that should have no usable password.

Sources

Every price and fact above was checked against these pages on the date shown.

  1. [1] Help Net Security: OpenSSH flaw exploited in the wild just hours after disclosure accessed 2026-11-11
  2. [2] BleepingComputer: Hackers exploit SSHole OpenSSH flaw to breach Linux systems accessed 2026-11-11
  3. [3] Alpine Linux security tracker: CVE-2026-123158 accessed 2026-11-11
Topics opensshalpine-linuxcve-2026-123158containerspatching