# Meet *sshole, the vulnerability that lets hackers SSH into Linux devices

Source: [Biz & IT - Ars Technica](https://arstechnica.com/security/2026/11/vulnerability-allows-attackers-to-log-into-some-linux-devices-sans-password/) · 2026-11-05 · Industry
Page: https://themorning.dev/story/meet-sshole-the-vulnerability-that-lets-hackers-ssh-into-linux-devices-9ed3b44bda29df97
Kind: security · Impact: high

## In brief

- A decade-old OpenSSH flaw, nicknamed *sshole and tracked as CVE-2026-123158 with a CVSS score of 8.1, lets remote attackers log into passwordless accounts on some musl-based systems without PAM, such as Alpine Linux.
- On affected systems, accounts accept a very long password (sources say 256 or more characters, or 257 to 1024 characters).
- Previdian reports exploitation in the wild within hours of disclosure, and fixes are available.

## Why it matters

If you run openssh-server on Alpine or another musl-based system without PAM, an account with no password may be reachable over SSH by anyone who sends a long password, so patch and check your exposure now.

## What to do

- Update openssh-server to the patched version provided by your distribution
- Check whether any accounts have no password set and are reachable over SSH

## CVEs

- CVE-2026-123158

## Timeline

- 2026-11-05: Alpine Linux publishes an advisory on the openssh-server password authentication bypass
- 2026-11-06: OpenSSH fixes are released for the flaw
- 2026-11-06: Previdian reports that attackers are exploiting the flaw
- 2026-11-08: SANS Internet Storm Center reports an increase in exploitation attempts

## Coverage

- [Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th)](https://isc.sans.edu/diary/rss/33498) — SANS Internet Storm Center, InfoCON: green, 2026-11-08
- [Re: "sshole": password authentication bypass: OpenSSH + musl libc](https://seclists.org/oss-sec/2026/q4/573) — Open Source Security, 2026-11-07
- [Re: "sshole": password authentication bypass: OpenSSH + musl libc](https://seclists.org/oss-sec/2026/q4/572) — Open Source Security, 2026-11-07
- [Alpine Linux : openssh-server password authentication bypass](https://www.alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/) — Lobsters, 2026-11-07
- [Re: "sshole": password authentication bypass: OpenSSH + musl libc](https://seclists.org/oss-sec/2026/q4/571) — Open Source Security, 2026-11-07
- [Re: "sshole": password authentication bypass: OpenSSH + musl libc](https://seclists.org/oss-sec/2026/q4/570) — Open Source Security, 2026-11-07
- [Re: "sshole": password authentication bypass: OpenSSH + musl libc](https://seclists.org/oss-sec/2026/q4/569) — Open Source Security, 2026-11-07
- [Re: "sshole": password authentication bypass: OpenSSH + musl libc](https://seclists.org/oss-sec/2026/q4/568) — Open Source Security, 2026-11-07
- [Re: "sshole": password authentication bypass: OpenSSH + musl libc](https://seclists.org/oss-sec/2026/q4/567) — Open Source Security, 2026-11-07
- [Re: "sshole": password authentication bypass: OpenSSH + musl libc](https://seclists.org/oss-sec/2026/q4/566) — Open Source Security, 2026-11-07
- [CVE-2026-123158 (*sshole): OpenSSH Password Authentication Bypass on Alpine Linux](https://www.stepsecurity.io/blog/cve-2026-123158-sshhole-openssh-musl-password-bypass) — Step Security Blog, 2026-11-06
- [Re: "sshole": password authentication bypass: OpenSSH + musl libc](https://seclists.org/oss-sec/2026/q4/555) — Open Source Security, 2026-11-06
- [Re: "sshole": password authentication bypass: OpenSSH + musl libc](https://seclists.org/oss-sec/2026/q4/554) — Open Source Security, 2026-11-06
- [Researcher: *sshole, a decade-old OpenSSH flaw, lets attackers use a password of 256+ characters to log into passwordless accounts on some musl Linux systems (Lawrence Abrams/BleepingComputer)](https://www.techmeme.com/261106/p16#a261106p16) — Techmeme, 2026-11-06
- [Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot](https://thehackernews.com/2026/11/hackers-exploited-openssh-sshole-flaw.html) — The Hacker News, 2026-11-06
- [OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158)](https://www.helpnetsecurity.com/2026/11/06/openssh-sshole-cve-2026-123158-exploitation/) — Help Net Security, 2026-11-06
- [OpenSSH Rushes Patches for ‘SSHole’ Authentication Bypass](https://www.securityweek.com/openssh-rushes-patches-for-sshole-authentication-bypass/) — SecurityWeek, 2026-11-06
- [Re: "sshole": password authentication bypass: OpenSSH + musl libc](https://seclists.org/oss-sec/2026/q4/539) — Open Source Security, 2026-11-06
- [Risky Bulletin: Some OpenSSH instances take any password longer than 256 characters](https://news.risky.biz/risky-bulletin-some-openssh-instances-take-any-password-longer-than-256-characters/) — Risky.Biz, 2026-11-06
- [Re: "sshole": password authentication bypass: OpenSSH + musl libc](https://seclists.org/oss-sec/2026/q4/537) — Open Source Security, 2026-11-06
- [Re: "sshole": password authentication bypass: OpenSSH + musl libc](https://seclists.org/oss-sec/2026/q4/536) — Open Source Security, 2026-11-06
- [Re: "sshole": password authentication bypass: OpenSSH + musl libc](https://seclists.org/oss-sec/2026/q4/535) — Open Source Security, 2026-11-06
- [Re: "sshole": password authentication bypass: OpenSSH + musl libc](https://seclists.org/oss-sec/2026/q4/534) — Open Source Security, 2026-11-05
- [Meet *sshole, the vulnerability that lets hackers SSH into Linux devices](https://arstechnica.com/security/2026/11/vulnerability-allows-attackers-to-log-into-some-linux-devices-sans-password/) — Biz & IT - Ars Technica, 2026-11-05
- [Re: "sshole": password authentication bypass: OpenSSH + musl libc](https://seclists.org/oss-sec/2026/q4/533) — Open Source Security, 2026-11-05
- [Re: "sshole": password authentication bypass: OpenSSH + musl libc](https://seclists.org/oss-sec/2026/q4/528) — Open Source Security, 2026-11-05
- [OpenSSH flaw lets attackers log into password-disabled Linux accounts](https://www.bleepingcomputer.com/news/security/openssh-flaw-lets-attackers-log-into-password-disabled-linux-accounts/) — BleepingComputer, 2026-11-05
- [OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux](https://thehackernews.com/2026/11/openssh-issues-emergency-fix-for-flaw.html) — The Hacker News, 2026-11-05
- [Alpine Linux Security advisory: OpenSSH-server password authentication bypass](https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/) — Hacker News: Front Page, 2026-11-05
- [OpenSSH 10.6p2 Critical workaround for alpine without PAM](https://www.openssh.org/releasenotes.html#10.6p2) — Hacker News: Front Page, 2026-11-05
- [Critical security vulnerability affects OpenSSH on Alpine Linux systems](https://lwn.net/Articles/1105464/) — LWN.net, 2026-11-05
- [OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability](https://hachyderm.io/@damienmiller/117563026759098135) — Hacker News: Front Page, 2026-11-05

## Discussions

- [Lobsters](https://lobste.rs/s/7dbarm): 1 points, 0 comments

Tags: openssh, security, vulnerability, alpine-linux, musl, authentication

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev