OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux

Live updates

1. 1h ago

   OpenSSH 10.6p2 fixes Alpine Linux password bypass flaw CVE-2026-123158

   OpenSSH released version 10.6p2 on 5 November 2026 to patch CVE-2026-123158, a critical authentication bypass affecting Alpine Linux and other musl libc systems without PAM. The flaw, nicknamed "sshole," allows any password of 257 bytes or longer to succeed during password authentication, granting unauthorized access. The vulnerability carries a CVSS score of 8.1 and has been added to the CISA Known Exploited Vulnerabilities catalog. Attackers began targeting the flaw within hours of public disclosure, achieving root access on honeypot systems. Affected deployments include containerized environments running Alpine.

   Why it matters

   The bug stems from how OpenSSH interacts with musl libc's crypt() function when PAM is absent, causing a length check to fail silently for long passwords. Alpine Linux is widely used in containers and embedded devices, making the attack surface large. Because the flaw permits authentication bypass with no valid credentials, it poses immediate risk to internet-exposed SSH servers. The rapid exploitation underscores the urgency of patching or applying mitigations.

   What is confirmed

   • CVE-2026-123158 allows password authentication bypass on OpenSSH running on Alpine Linux and other musl libc systems without PAM.
   • The vulnerability triggers when a password of 257 bytes or longer is supplied.
   • OpenSSH 10.6p2, released 5 November 2026, fixes the flaw.
   • The vulnerability has a CVSS score of 8.1 and is listed in the CISA Known Exploited Vulnerabilities catalog.
   • Attackers exploited the flaw within hours of public disclosure, gaining root access on honeypot systems.

   Still unconfirmed

   • The discoverer refers to the vulnerability as "sshole."
   • Containerized Alpine environments are a primary target due to widespread deployment.

   What to watch next

   • Alpine Linux package update availability and adoption rate
   • CISA binding operational directive deadlines for federal agencies
   • Proof-of-concept exploit code proliferation in public repositories
   Sources used for this update (11)

   1. Ars Technica — Meet *sshole, the vulnerability that lets hackers SSH into Linux devices
   2. The Hacker News — OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux
   3. The Hacker News — Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot
   4. SecurityWeek — OpenSSH Rushes Patches for ‘SSHole’ Authentication Bypass
   5. Security Boulevard — SSHhole (CVE-2026-123158) and how IONIX is helping you respond
   6. flawfence.com — CVE-2026-123158 (sshole): OpenSSH on Alpine, fixed versions ...
   7. enersys.co.th — OpenSSH CVE-2026-123158: SSH Password Bypass on Alpine Linux ...
   8. www.intertecsystems.com — Misconfigured SSH Password Authentication Exposes Alpine ...
   9. linuxsecurity.com — Alpine OpenSSH Login Bypass Risks for Key-Only Accounts
   10. labs.cloudsecurityalliance.org — Any Long Password Works: CVE-2026-123158 and the Alpine/musl ...
   11. shattered.io — OpenSSH musl Password Bypass: 257-Byte Fix [2026]
   confidence 90%