International
The Morning Dev

Only the news worth knowing

‹
 
S97/100

Vulnerability · high · CVSS 8.1

OpenSSH password authentication flaw on musl/Alpine systems allows logins

Tier S · Shit hits the fan – Drop everything

Who’s exposed: OpenSSH on musl libc systems without PAM, password auth enabled

Tier S because: Core infrastructure AND exploited in the wild AND (full takeover OR secrets exposed)

Reach

Attack

Damage

Fix

Core infrastructure · Popular tool · Exploited in the wild · Public exploit · Remote, no login · Full takeover · Secrets exposed · No fix yet

What to do

  1. Check whether your OpenSSH runs on musl libc without PAM and with password authentication enabled.
  2. Watch for an OpenSSH or musl fix and apply it as soon as it is released.

The Brief

  • Authentication bypass in OpenSSH (CVE-2026-123158), dubbed "SSHole", affects systems using musl libc without PAM.
  • BleepingComputer and SecurityWeek report active exploitation by botnets, crypto miners and other attackers; SANS saw rising exploit attempts in its honeypots.
  • Medcrypt reproduced the issue on a stock Yocto image; musl maintainer Rich Felker says behaviour may change to always return null on failure in the next release cycle.

Why it matters

Attackers are already exploiting this to run commands, steal credentials and establish persistent access, and the affected configuration can occur in stock or common builds.

The checklist behind the tier

Checklist · 9 of 10 yes
YesHits tech teamsReason: OpenSSH on Alpine/musl servers is run and maintained by ops and IT teams.
YesCore infrastructureReason: OpenSSH is core infrastructure nearly every team runs.
YesPopular toolReason: OpenSSH is a widely used, mainstream server package.
YesExploited in the wildCISA SSVCCISA rates exploitation of CVE-2026-123158 as active
YesPublic exploitCVE.orgCVE-2026-123158 record links an exploit: sshhole.com
YesRemote, no loginCVSSCVE-2026-123158: CVSS 8.1 – network, no privileges, no user interaction
YesFull takeoverCVSSCVE-2026-123158: CVSS rates confidentiality and integrity impact high
YesSecrets exposedBleepingComputer: hackers exploiting the flaw steal credentials.
NoSupply chainNo source reports compromised packages, updates, build pipelines or signing keys.
YesNo fix yetOss-security (Rich Felker): musl behavior change only 'possibly' coming in next release cycle; no patched release cited.

The official record

From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.

  • CVE-2026-123158 ↗CVSS 8.1 high AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

    sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256

    Exploited
    CISA rates exploitation active
    EPSS
    17% chance of exploitation in the next 30 days · higher than 97% of all CVEs
    Weakness
    CWE-394

    NVDGHSA-4fcc-vm97-gx3x

Timeline

  1. Hacker News: Front Page

    OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability

  2. LWN.net

    Critical security vulnerability affects OpenSSH on Alpine Linux systems

  3. Hacker News: Front Page

    OpenSSH 10.6p2 Critical workaround for alpine without PAM

  4. Hacker News: Front Page

    Alpine Linux Security advisory: OpenSSH-server password authentication bypass

  5. The Hacker News

    OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux

  6. BleepingComputer

    OpenSSH flaw lets attackers log into password-disabled Linux accounts

  7. Open Source Security

    Re: "sshole": password authentication bypass: OpenSSH + musl libc · +18 replies

  8. Biz & IT - Ars Technica

    Meet *sshole, the vulnerability that lets hackers SSH into Linux devices

  9. Risky.Biz

    Risky Bulletin: Some OpenSSH instances take any password longer than 256 characters

  10. SecurityWeek

    OpenSSH Rushes Patches for ‘SSHole’ Authentication Bypass

  11. Help Net Security

    OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158)

  12. The Hacker News

    Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot

  13. Techmeme

    Researcher: *sshole, a decade-old OpenSSH flaw, lets attackers use a password of 256+ characters to log into passwordless accounts on some musl Linux systems (Lawrence Abrams/BleepingComputer)

  14. Step Security Blog

    CVE-2026-123158 (*sshole): OpenSSH Password Authentication Bypass on Alpine Linux

  15. Lobsters

    Alpine Linux : openssh-server password authentication bypass

  16. Lobsters

    1 points · 0 comments

  17. SANS reports increased exploitation attempts in its honeypots after the vulnerability emerged the previous week

  18. SANS Internet Storm Center, InfoCON: green

    Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th)

  19. SecurityWeek and BleepingComputer report active exploitation by botnets, crypto miners and other attackers

  20. SecurityWeek

    Hackers Exploiting ‘SSHole’ Authentication Bypass in OpenSSH

  21. BleepingComputer

    Hackers exploit SSHole OpenSSH flaw to breach Linux systems

  22. Open Source Security

    Re: [musl] Re: [oss-security] "sshole": password authentication bypass: OpenSSH + musl libc

  23. Schneier on Security

    New OpenSSH Vulnerability

  24. top scoring links : programming

    Why OpenSSH Accepts a Password It Shouldn’t | Patch Notes

Full coverage · 39 sources

What developers are saying

Based on 0 comments

First seen · 39 sources · Full story page · How tiers are decided