International
The Morning Dev

Only the news worth knowing

‹
 
S97/100

Vulnerability · high · CVSS 8.1

OpenSSH password authentication flaw on musl/Alpine systems allows logins (CVE-2026-123158)

Tier S · Shit hits the fan – Drop everything

Who’s exposed: musl-based systems with password authentication enabled and no PAM

Tier S because: Core infrastructure AND exploited in the wild AND (full takeover OR secrets exposed)

Reach

Attack

Damage

Fix

Core infrastructure · Popular tool · Exploited in the wild · Public exploit · Remote, no login · Full takeover · Secrets exposed · No fix yet

What to do

  1. Check whether any musl-based hosts run OpenSSH with password authentication enabled and no PAM configured

The Brief

  • A password authentication bypass in OpenSSH on musl-based systems (such as Alpine Linux) lets attackers log in by entering an empty password, per Schneier on Security.
  • SANS honeypots saw rising exploitation attempts for CVE-2026-123158 ("sshole") as of 2026-11-08.
  • BleepingComputer and SecurityWeek report active exploitation by botnets and crypto miners, with attackers running commands, stealing credentials, and establishing persistence.

Why it matters

Systems that use musl with OpenSSH password authentication enabled and no PAM can be logged into without valid credentials, and the flaw has reportedly been in the code for a decade.

The checklist behind the tier

Checklist · 9 of 10 yes
YesHits tech teamsJudgment: OpenSSH on Alpine/musl servers is run and maintained by ops and IT teams.
YesCore infrastructureJudgment: OpenSSH is core infrastructure nearly every team runs.
YesPopular toolJudgment: OpenSSH is a widely used mainstream server and tool; implied by coreInfra.
YesExploited in the wildCISA SSVCCISA rates exploitation of CVE-2026-123158 as active
YesPublic exploitCVE.orgCVE-2026-123158 record links an exploit: sshhole.com
YesRemote, no loginCVSSCVE-2026-123158: CVSS 8.1 – network, no privileges, no user interaction
YesFull takeoverCVSSCVE-2026-123158: CVSS rates confidentiality and integrity impact high
YesSecrets exposedBleepingComputer: Hackers exploit the flaw to steal credentials.
NoSupply chainFlaw is a normal authentication bug in OpenSSH and musl; no malicious shipped code reported.
YesNo fix yetOpen Source Security: musl change only possibly next release cycle; Alpine fix is a proposed build option.

The official record

From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.

  • CVE-2026-123158 ↗CVSS 8.1 high AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

    sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256

    Exploited
    CISA rates exploitation active
    EPSS
    17% chance of exploitation in the next 30 days · higher than 97% of all CVEs
    Weakness
    CWE-394

    NVDGHSA-4fcc-vm97-gx3x

Timeline

  1. Hacker News: Front Page

    OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability

  2. LWN.net

    Critical security vulnerability affects OpenSSH on Alpine Linux systems

  3. Hacker News: Front Page

    OpenSSH 10.6p2 Critical workaround for alpine without PAM

  4. Hacker News: Front Page

    Alpine Linux Security advisory: OpenSSH-server password authentication bypass

  5. The Hacker News

    OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux

  6. BleepingComputer

    OpenSSH flaw lets attackers log into password-disabled Linux accounts

  7. Open Source Security

    Re: "sshole": password authentication bypass: OpenSSH + musl libc · +18 replies

  8. Biz & IT - Ars Technica

    Meet *sshole, the vulnerability that lets hackers SSH into Linux devices

  9. Risky.Biz

    Risky Bulletin: Some OpenSSH instances take any password longer than 256 characters

  10. SecurityWeek

    OpenSSH Rushes Patches for ‘SSHole’ Authentication Bypass

  11. Help Net Security

    OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158)

  12. The Hacker News

    Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot

  13. Techmeme

    Researcher: *sshole, a decade-old OpenSSH flaw, lets attackers use a password of 256+ characters to log into passwordless accounts on some musl Linux systems (Lawrence Abrams/BleepingComputer)

  14. Step Security Blog

    CVE-2026-123158 (*sshole): OpenSSH Password Authentication Bypass on Alpine Linux

  15. Lobsters

    Alpine Linux : openssh-server password authentication bypass

  16. Lobsters

    1 points · 0 comments

  17. SANS Internet Storm Center reports increased exploitation attempts against the sshole vulnerability in honeypot data

  18. SANS Internet Storm Center, InfoCON: green

    Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th)

  19. SecurityWeek and BleepingComputer report active exploitation by botnets, crypto miners and other threat actors

  20. Flaw discussed on oss-security; Medcrypt reports independent reproduction, including on a stock Yocto image

  21. SecurityWeek

    Hackers Exploiting ‘SSHole’ Authentication Bypass in OpenSSH

  22. BleepingComputer

    Hackers exploit SSHole OpenSSH flaw to breach Linux systems

  23. Open Source Security

    Re: [musl] Re: [oss-security] "sshole": password authentication bypass: OpenSSH + musl libc

  24. Schneier on Security

    New OpenSSH Vulnerability

  25. top scoring links : programming

    Why OpenSSH Accepts a Password It Shouldn’t | Patch Notes

  26. DEV Community: backend

    Type 257 Characters of Anything. You're In.

Full coverage · 40 sources

What developers are saying

Based on 0 comments

First seen · 40 sources · Full story page · How tiers are decided