Skip to content
audiotale.net
Sign in
NewsNews

CVE-2026-123158 sshole: OpenSSH 10.6p2 fixes Alpine login bypass, now exploited

A password of 257 bytes or more logs attackers into passwordless accounts on musl-based Linux such as Alpine; GreyNoise and Previdian have seen real intrusions.

audiotale.net team

· 7 min read

Written by AI from the sources linked below. How we use AI

On this page
  1. Key points
  2. What to do
  3. What happened
  4. Background
  5. How severe is it
  6. What it means
  7. What we don't know yet
  8. What to watch next
  9. Sources

Attackers are using a critical OpenSSH login bypass, CVE-2026-123158 (nicknamed "sshole" or "*sshole"), against Alpine Linux and other systems built on the musl C library, within hours of the OpenSSH fix and still active four days later. A single connection with an over-long password is enough to log in as an account that has no password, which on some stock Alpine cloud images means root. If you run sshd on Alpine, OpenWrt, Buildroot or Yocto, update and restart the daemon today.

Key points

  • CVE-2026-123158 is a password-authentication bypass in OpenSSH's sshd; it was fixed in OpenSSH 10.6p2, released on 5 November 2026.
  • It only affects Linux systems that run OpenSSH on the musl C library with PAM disabled, which is how Alpine Linux builds its default openssh-server package.
  • An attacker sends a password of 257 to 1,024 bytes for an account whose password field is * and is logged in with one connection, according to Alpine's advisory.
  • Previdian reported a first exploitation attempt less than nine hours after the CVE was published, and GreyNoise documented two hands-on intrusions on 7 and 8 November.
  • Debian, Ubuntu, Red Hat and other glibc systems are not affected; Red Hat's advisory says its products link OpenSSH against glibc and use PAM by default.

What to do

Who is affected. All four of these must be true, per Alpine's advisory:

  1. sshd runs without PAM: Alpine's openssh-server package, or openssh-server-pam with UsePAM no.
  2. PasswordAuthentication is yes, which is the OpenSSH default.
  3. At least one account has * in its password field. That includes key-only users created without a password, users supplied by a directory service through musl-nscd, root (shipped as root:* since about Alpine 3.16) and the alpine user in the official tiny-cloud images.
  4. At least one other local account has a $5$ or $6$ password hash.

Fix. Update OpenSSH, then restart sshd, because installing the package does not replace the running daemon. On Alpine:

apk upgrade -U -a
rc-service sshd restart

Alpine says the fixed packages are in its 3.21.10, 3.22.8, 3.23.8 and 3.24.4 releases, and lists fixed openssh versions for every branch back to 3.16 (for example 10.3_p1-r2 on 3.24 and 10.6_p2-r0 on edge). Because Alpine backported the patch, the version number printed by sshd -V does not tell you whether a stable-branch host is fixed; check the package version against Alpine's table.

Workaround if you cannot update yet. Set PasswordAuthentication no in your sshd configuration (every occurrence, including those inside Match blocks), run sshd -t, restart sshd, and confirm with sshd -T | grep -i passwordauthentication. Alpine advises keeping an existing session open while you test a key login. OpenSSH developer Damien Miller's advice, as relayed by Help Net Security, was blunter: turn off password authentication or disable SSH on these systems immediately.

Check whether you were hit. Alpine suggests searching /var/log/messages for "Accepted password for" lines that name an account with no password (alpine, root or a key-only user), then reviewing doas use, recently created users and authorized_keys files. If you cannot rule out a login, Alpine says to treat the machine as compromised.

Not affected: containers that do not run sshd, systems with PasswordAuthentication no, openssh-server-pam with UsePAM yes, accounts locked with !, hosts where no account has a $-style hash, and cloud images configured through cloud-init, which writes PasswordAuthentication no.

What happened

OpenSSH 10.6p2 came out on 5 November with a short security entry: it avoids a password-authentication bypass "exploitable through sshd(8)" on some Linux systems built and run without PAM. The project added that it considers the root cause to be outside sshd, but that the bug can be avoided there. The bug was reported by Özgün Kültekin of Wakefield. Alpine published fixed packages the same day. At the time of its advisory no CVE had been assigned; the identifier CVE-2026-123158 followed, and SOCRadar reports the record was published on 5 November.

Exploitation followed quickly. Previdian founder Ryan Dewhurst told Help Net Security that the first observed attempt arrived less than nine hours after the CVE was published, and that the company confirmed successful root access on a honeypot running real Alpine and OpenSSH. As of that 6 November report, Previdian had counted eight attempts, all from one Japan-based address, which ran reconnaissance commands such as id, uname and hostname. According to Ars Technica on 9 November, Previdian's sensors have since seen 20 attempts from 13 addresses in nine countries, and watchTowr reported exploitation tied to botnets and cryptocurrency.

The most detailed picture comes from GreyNoise, which on Monday 9 November described a cluster it tracks as GT10. Its SSHole activity page lists two intrusions it saw first-hand: one on 7 November from 10:12 to 13:52 UTC (23 shell sessions, 87 commands) and one from 19:41 UTC on 7 November to 12:44 UTC on 8 November (25 shells, 135 commands). The operators ran discovery and network tests, staged tools, and in the first case changed name resolution and installed a backdoor SSH server and a command-and-control agent. GreyNoise says not all SSHole activity belongs to GT10, and that some of the addresses it lists may be legitimate machines that were compromised.

Background

The flaw sits where three old decisions meet. In 2016, OpenSSH changed sshd to close a timing leak, CVE-2016-6210, that let attackers work out which usernames exist. When an account has no usable hash, such as a lone *, sshd now borrows the salt from another account's real hash and hashes the supplied password anyway, so every login attempt takes similar time. Separately, musl's crypt() function has since 2012 refused SHA-256 and SHA-512 passwords longer than 256 bytes, and when it refuses it returns the string * instead of an error.

Put together: for a passwordless account, the stored value is *. An over-long guess makes musl's crypt() return *. sshd compares the two, sees a match and lets the attacker in. This is the "misinterpretation of whether a string is intended to be a password hash" that Red Hat's advisory describes. SOCRadar says the OpenSSH fix makes sshd reject a match whenever the stored password field is shorter than four characters. Help Net Security reports that Kültekin built sshd in many combinations and tried some 17,600 unusual logins against them; only the musl build without PAM let in logins it should have refused.

Alpine is the main exposure because its default OpenSSH package is built without PAM, and it is popular as a small base for containers, appliances and cloud images. Kültekin names OpenWrt, Buildroot and Yocto as other musl-based systems worth checking, although he says Dropbear, OpenWrt's default SSH server, is not affected (SOCRadar relays this).

How severe is it

Sources disagree on the score, so we show both. According to SOCRadar, the CVE record supplied by MITRE rates it CVSS 3.1 8.1 (High), with attack complexity High. Red Hat's preliminary score is 9.8 (Critical) with attack complexity Low, though Red Hat also says its own products are not affected and that scores for open-source components depend on how a vendor builds them. The OpenSSH project itself calls the fix a "critical" workaround. What is not in dispute is how easy it is: Alpine says the attack needs one connection and works every time.

Commands run in each GreyNoise-observed GT10 intrusioncommands
Commands run in each GreyNoise-observed GT10 intrusion (commands)
commands
Intrusion 187
Intrusion 2135

Source: GreyNoise SSHole activity page

What it means

For operators of Alpine-based servers, the lesson is practical: the safest SSH configuration is the one that never accepts a password. Key-only accounts were meant to be unreachable by password, and this bug is the reason that assumption needs a config line rather than trust. Cloud images that ship with cloud-init defaults are in better shape, as are glibc distributions, but the long tail of embedded devices and containers that include their own sshd is harder to inventory.

For maintainers, the OpenSSH release notes make a point beyond this bug. The team says it has recently received a large number of security reports, many found by or with AI tools, and that bugs found by AI are often discovered independently by someone else, so it will make more frequent releases instead of batching fixes. Dewhurst's view, in Help Net Security, is that attackers are getting faster with AI assistance. The GT10 backdoor, per Ars, has Chinese-language comments and appears to be AI-generated, and Kültekin himself credits "agent swarms" for the research. The time between a fix and the first attack is now measured in hours.

What we don't know yet

  • How many internet-facing hosts are actually exploitable. The four conditions narrow it a lot, and none of our sources gives a count.
  • Whether the activity is one campaign or several. GreyNoise says GT10 is only part of what it sees, and Previdian and watchTowr describe different behaviour.
  • Whether CISA will add the CVE to its Known Exploited Vulnerabilities catalog. Help Net Security said on 6 November that it had not; we have not rechecked the catalog since.
  • Whether the public proof-of-concept code is safe. Previdian cautions that the GitHub exploits it has seen are unverified and could contain malware, so do not run them.
  • The official score. NVD listed the record as received but not analysed as of SOCRadar's 6 November write-up.

What to watch next

Watch for fixed packages from other musl-based distributions and embedded vendors, since the OpenSSH change is a workaround and musl's behaviour is the root cause in the project's view. Watch GreyNoise's page for new addresses and indicators, and for a CISA KEV decision. And if you maintain images that include sshd, add a check that password authentication is off.

Sources

SaveStart the discussion

Written by

audiotale.net team

The official account of the people who run audiotale.net: announcements, conversation starters and the newsroom's drafts. Posts written with AI say so. Every other account here is a real person.

Read next