SSHole CVE-2026-123158: A 10-Year-Old OpenSSH Flaw Hiding in musl
CVE-2026-123158 (SSHole) is an authentication bypass in OpenSSH sshd built against musl libc without PAM, the default for Alpine Linux openssh-server. An unauthenticated attacker gains an interactive shell as a local user.
Summary
CVE-2026-123158, nicknamed SSHole, lets an unauthenticated network attacker gain an interactive shell as a legitimate local user, bypassing authentication entirely. Official Alpine tiny-cloud images are most exposed: their "alpine" user has a "*" password field and passwordless doas, so a single long password can yield root once any SHA-512 hash exists on the host.
Exposure extends to container fleets, CI runners, and IoT devices built on Alpine with default sshd settings, and to other musl-based platforms such as OpenWrt, Buildroot, and Yocto. Consequences include data theft, lateral movement, persistence, and supply-chain compromise through build hosts or golden images.
| CVE | Name | Affected product |
|---|---|---|
| CVE-2026-123158 | OpenBSD OpenSSH *sshole (OpenSSH Password Authentication Bypass Vulnerability) | OpenSSH (portable, musl without PAM); Alpine Linux openssh-server |
Vulnerability Details
CVE-2026-123158 is an authentication bypass in OpenSSH's sshd when it is compiled against musl libc without PAM. Classified as CWE-394 (Unexpected Status Code or Return Value), it occurs because sshd treats the error string returned by musl's crypt() as a valid password hash.
Without PAM, sshd verifies a password by running crypt() with the stored salt and comparing the result to the shadow entry. For accounts with a "*" field, sshd borrows another account's salt, a side effect of its 2016 user-enumeration hardening (CVE-2016-6210). musl's crypt() returns "*" on failure and rejects keys over 256 bytes, so a password longer than 256 bytes produces "*", matches the stored field, and the login is accepted. OpenSSH 10.6p2 changes sshd so it no longer triggers this library behaviour.
The flaw sits at the boundary between OpenSSH and the C library rather than in either component alone, so it affects only portable OpenSSH builds linked against musl libc with PAM disabled. That combination is Alpine Linux's default openssh-server, which is widely used as a base for containers and cloud images. A successful bypass authenticates the attacker as the targeted account and grants an interactive shell with that account's privileges. glibc-based distributions and systems that authenticate through PAM are not affected.
Exploitation is remote and needs no credentials or user interaction, only network access to SSH and a target account whose password field is "*". The host must run sshd without PAM and with PasswordAuthentication enabled (both Alpine defaults), and have at least one other account with a $5$ or $6$ hash. Root is protected by the default PermitRootLogin prohibit-password, but Alpine's switch of root's locked marker from "!" to "*" widened the set of matching accounts.
The vulnerability has a CVSS v3.1 base score of 8.1 (High); the High attack complexity reflects the account and configuration preconditions. Public reproduction repositories exist and the trigger is trivial, so exploitation attempts should be expected. Alpine advises treating any host as compromised if a password-accepted login on a passwordless account cannot be ruled out.
Affected products, CPE and CWE
| CVE ID | Affected products | Affected CPE | CWE ID |
|---|---|---|---|
| CVE-2026-123158 | OpenSSH portable sshd: versions before 10.6p2 built with musl libc and without PAM; Alpine Linux: all releases through 3.24 and edge (openssh-server package) | cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*cpe:2.3:o:alpinelinux:alpine_linux:*:*:*:*:*:*:*:* | CWE-394 |
Recommendations
- 01
Upgrade OpenSSH and Restart sshd Immediately
On Alpine Linux, run
apk upgrade -U -ato install the fixed openssh package for your branch (edge10.6_p2-r0through 3.169.0_p1-r6), then restart sshd withrc-service sshd restart, since upgrading alone does not load the patched binary. Systems building OpenSSH from source on musl should move to OpenSSH10.6p2. - 02
Rebuild and Redeploy Container and Cloud Images
Rebuild every image and cloud template that bundles openssh-server on Alpine against the fixed packages, and redeploy running workloads. Replace official Alpine tiny-cloud images 3.18.11 through 3.24.3, which ship the passwordless "alpine" user with doas access to root.
- 03
Disable Password Authentication Where Patching Is Not Possible
Set
PasswordAuthentication noin a drop-in under/etc/ssh/sshd_config.d/, validate withsshd -t, and restart sshd after confirming key-based logins work. This is the only fix for Alpine releases older than 3.16, which should be migrated to a supported release. - 04
Restrict Network Exposure of SSH
Limit SSH access to trusted management networks, bastion hosts, or VPNs through security groups and host firewalls, since exploitation needs only network access to the SSH port.
- 05
Audit Accounts with Locked or Empty Password Fields
Inventory accounts whose shadow password field is "*", including key-only service users and cloud default users, and remove those that do not need SSH access. Restrict logins with
AllowUsersorAllowGroups, and remove passwordless doas or sudo grants.
MITRE ATT&CK TTPs
T1133External Remote ServicesT1190Exploit Public-Facing ApplicationT1078Valid AccountsT1078.003Local AccountsT1136Create AccountT1136.001Local AccountT1098Account ManipulationT1098.004SSH Authorized KeysT1548Abuse Elevation Control MechanismT1548.003Sudo and Sudo CachingT1021Remote ServicesT1021.004SSHReferences & Patch Links
Patch links
References
- https://sshhole.com/
- https://cycode.com/blog/sshole-cve-2026-123158-openssh-alpine-linux-vulnerability
- https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/
- https://www.openssh.org/releasenotes.html#10.6p2
What Next?
At Hive Pro, it is our mission to detect the most likely threats to your organization and to help you prevent them from happening.
.svg)