OpenSSH password authentication flaw on musl/Alpine systems without PAM, with disputed claims

Tier S · Shit hits the fan – Drop everything

Who’s exposed: Passwordless accounts on musl-based systems without PAM, such as Alpine

Tier S because: Core infrastructure AND exploited in the wild AND (full takeover OR secrets exposed)

Reach

Attack

Damage

Fix

Core infrastructure · Popular tool · Exploited in the wild · Public exploit · Remote, no login · Full takeover

CVE-2026-123158 ↗

What to do

Update openssh-server to the patched version provided by your distribution
Check whether any accounts have no password set and are reachable over SSH

The Brief

A decade-old OpenSSH flaw, nicknamed *sshole and tracked as CVE-2026-123158 with a CVSS score of 8.1, lets remote attackers log into passwordless accounts on some musl-based systems without PAM, such as Alpine Linux.
On affected systems, accounts accept a very long password (sources say 256 or more characters, or 257 to 1024 characters).
Previdian reports exploitation in the wild within hours of disclosure, and fixes are available.

Why it matters

If you run openssh-server on Alpine or another musl-based system without PAM, an account with no password may be reachable over SSH by anyone who sends a long password, so patch and check your exposure now.

The checklist behind the tier

Checklist · 7 of 10 yes

Yes	Hits tech teams	Judgment: OpenSSH server flaw affects Linux systems that developers and ops teams run.
Yes	Core infrastructure	Judgment: OpenSSH is core infrastructure that nearly every team runs.
Yes	Popular tool	Judgment: OpenSSH is a widely used mainstream tool; core infrastructure implies yes.
Yes	Exploited in the wild	Help Net Security: flaw CVE-2026-123158 is being exploited in the wild per Previdian; SANS reports rising exploit attempts.
Yes	Public exploit	CISA SSVCCISA rates exploitation of CVE-2026-123158 as proof of concept public
Yes	Remote, no login	CVSSCVE-2026-123158: CVSS 8.1 – network, no privileges, no user interaction
Yes	Full takeover	CVSSCVE-2026-123158: CVSS rates confidentiality and integrity impact high
No	Secrets exposed	No source reports credentials, keys, configs or data being stolen or exposed.
No	Supply chain	No source reports compromised packages, updates, build pipelines or signing keys.
No	No fix yet	Help Net Security says the flaw was fixed; SecurityWeek reports OpenSSH rushed patches out.

The official record

From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.

CVE-2026-123158 ↗CVSS 8.1 high AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256
Exploited
Proof of concept public (CISA)
EPSS
1.0% chance of exploitation in the next 30 days · higher than 63% of all CVEs
Weakness
CWE-394
NVD GHSA-4fcc-vm97-gx3x