OpenSSH SSHole CVE-2026-123158: patch to 10.6p2, check logins

TL;DR: CVE-2026-123158 — a password authentication bypass in OpenSSH on musl Linux without PAM, nicknamed SSHole in public tracking — is on CISA’s KEV list (added November 9, 2026). Portable OpenSSH 10.6p2 (November 5, 2026) adds a workaround in sshd. Alpine and other musl hosts should update, restart sshd, or turn off password logins, then check auth logs for unexpected password accepts on key-only accounts.

What happened

• November 5, 2026: Portable OpenSSH 10.6p2 was released. The release notes call out a critical security workaround for Linux systems that use musl libc with PAM disabled. The OpenSSH team says the root cause sits outside sshd, but the bypass is exploitable through it. Reported by Özgün Kültekin of Wakefield.
• Same day: Alpine Linux published a security advisory for openssh-server password authentication bypass, with fixed packages across branches back to 3.16. Alpine noted that no CVE had been assigned yet at the time of writing.
• November 5 (NVD / GHSA): The flaw is tracked as CVE-2026-123158 / GHSA-4fcc-vm97-gx3x. NVD and GHSA describe OpenSSH before 10.6p2 on Linux when musl is used without PAM; CVSS 3.1 base 8.1 (High) (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
• November 9, 2026: CISA added CVE-2026-123158 to the Known Exploited Vulnerabilities catalog (catalogVersion 2026.11.09). Federal due date November 12, 2026. Forensic triage under BOD 26-04: Yes. Known ransomware use: Unknown.

How the attack works

Per Alpine (and consistent with the NVD/GHSA summary): when sshd is built without PAM, it checks passwords with the C library crypt() and compares the result to the stored password field. For accounts whose stored field is too short to hold a salt, sshd borrows a salt from another account.

On musl, crypt() returns the string * as an error indicator when the key is over 256 bytes. Accounts with no password set also store exactly * in /etc/shadow. A matching * is treated as a successful password check.

Alpine’s conditions for exposure (all must be true):

1. sshd on musl without PAM (Alpine’s default openssh-server, or openssh-server-pam with UsePAM no).
2. PasswordAuthentication yes (OpenSSH default unless changed).
3. An account whose password field is exactly * (key-only users, many directory-mapped users, Alpine’s default alpine cloud user; root:* in base images — OpenSSH’s default PermitRootLogin prohibit-password still blocks root password login unless that was changed).
4. At least one other local account has a real $5$ or $6$ password hash (so a salt can be borrowed).

The attacker needs network reachability to sshd and a username; Alpine says a very long password then succeeds in one try.

Password-length wording conflict: Alpine says 257 to 1024 bytes. NVD and GHSA say between 256 and 1024 characters. We report both; Alpine’s figure matches musl’s over-256-byte failure path.

OpenSSH’s 10.6p2 notes do not spell out the musl/* mechanism in the short security blurb; they document the workaround and the reporter. Mechanism detail above is from Alpine’s advisory.

Who is exposed

Linux hosts running OpenSSH before 10.6p2 (or an unpatched distro backport) on musl without PAM, with password authentication enabled and at least one *-field account plus one salted hash account — as above. Alpine lists containers that do not run sshd as not affected; same for PasswordAuthentication no, PAM-enabled builds with UsePAM yes, locked ! password fields, and hosts with no $-style password hash.

Not a general glibc/OpenSSH-everywhere bug on the primary pages we read: the documented scope is musl + no PAM.

Exploitation status

CISA’s KEV entry (date added 2026-11-09, due 2026-11-12) is the primary signal we use for known exploitation. NVD’s CISA Coordinator SSVC options for this CVE include exploitation: active. OpenSSH’s release notes and Alpine’s advisory do not themselves describe in-the-wild campaigns; Alpine focuses on the bug, packages, and log checks. Known ransomware campaign use on KEV: Unknown.

What to do

1. Update OpenSSH to 10.6p2 (or your distro’s fixed package — Alpine table above), then restart sshd. Package install alone is not enough on Alpine.
2. If you cannot update yet: set PasswordAuthentication no, keep a working key session, sshd -t, restart, confirm with sshd -T.
3. Then check whether you were already hit (patching does not erase a past login):
   • Accepted password for on accounts that should be key-only / * in shadow.
   • Unexpected users, authorized_keys changes, and privilege helpers such as doas on Alpine tiny-cloud.
4. If you cannot rule that out, treat the host as compromised and rebuild/rotate as appropriate.

For related patch alerts, see our security coverage.

Sources

• OpenSSH 10.6p2 release notes (Security: password authentication bypass workaround) - https://www.openssh.org/releasenotes.html#10.6p2
• Alpine Linux: “Security advisory: openssh-server password authentication bypass” (November 5, 2026) - https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/
• NVD: CVE-2026-123158 - https://nvd.nist.gov/vuln/detail/CVE-2026-123158
• GitHub Advisory Database: GHSA-4fcc-vm97-gx3x / CVE-2026-123158 - https://github.com/advisories/GHSA-4fcc-vm97-gx3x
• OpenSSH portable commit (workaround): 4353fdc43ef646c43a8dda7025cc1a898caf1482 - https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482
• CISA Known Exploited Vulnerabilities catalog (catalogVersion 2026.11.09; CVE-2026-123158 added 2026-11-09) - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• CISA KEV JSON feed - https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

Last checked: Nov 10, 2026, 8:28 a.m. Manila (UTC+8). Method: We read OpenSSH’s 10.6p2 release notes on openssh.org, Alpine’s November 5 advisory (affected conditions, package table, interim PasswordAuthentication disable, compromise log check), the NVD CVE-2026-123158 record (description, CVSS 3.1 8.1, CISA KEV dates, SSVC exploitation active), GHSA-4fcc-vm97-gx3x via the GitHub Advisories API (same description/CVSS; HTML advisory page was a thin shell), the openssh-portable workaround commit message, and CISA’s KEV JSON feed catalogVersion 2026.11.09 (dateReleased 2026-11-09T19:54:37Z). BleepingComputer URLs returned HTTP 403 to our fetcher today, so we did not use BC as a source. OpenSSH/Alpine did not use the “SSHole” nickname on the pages we read; we keep it as the public short name used with this CVE. Thumbnail is an original One Signal Desk topic graphic. No affiliate links. How we work.

Updates

• Nov 10, 2026, 8:28 a.m. Manila (UTC+8): Initial report covering the OpenSSH workaround, Alpine fixed packages and CISA KEV listing.