OpenSSH "SSHole": an exploited flaw on Alpine

On November 5, 2026, OpenSSH released version 10.6p2 with an emergency fix. The flaw, CVE-2026-123158, nicknamed "SSHole", lets an attacker open an SSH session without knowing the password on some Linux systems that use the musl library without PAM. Alpine Linux is the typical case. Exploitation attempts were seen the next day, and CISA added it to the KEV catalog on November 9.

What happened

The flaw. According to the OpenSSH release notes, sshd had a password authentication bypass on some Linux systems built and run without PAM. The OpenSSH team places the root cause outside sshd, but the flaw is exploitable through sshd and can be avoided there. The NVD adds that, for some account configurations, any password between 256 and 1,024 characters succeeds. The CVSS score is 8.1.

The conditions. Alpine's advisory spells out what it takes to be affected:

• Alpine's openssh-server package, built without PAM, or openssh-server-pam with UsePAM no;
• PasswordAuthentication set to yes, the OpenSSH default;
• an account whose password field is "*", which is normal for a key-only account;
• at least one other local account with a $5$ or $6$ password hash.

Alpine sums it up: an attacker who can reach the SSH port can log in without a password, in one connection, every time. Every release checked is affected, from 3.16 to 3.24 and edge. Alpine adds that root ships with "*" in the base image since about 3.16, protected by default by PermitRootLogin prohibit-password, but that another account able to become root, for example through doas, is enough.

Who is not affected. Again according to Alpine: containers that do not run sshd, systems with PasswordAuthentication no, systems using PAM with UsePAM yes, accounts locked with "!", and cloud images configured by cloud-init, which turns password authentication off.

Exploitation. Previdian reports catching first attempts on November 6, less than a day after the CVE was published. It notes that these attempts do not prove the targets were vulnerable or that the attack succeeded. CISA added the flaw to KEV on November 9, with a November 12 deadline and forensic triage required. The Canadian Centre for Cyber Security relayed it in advisory AV26-1130.

Why it matters

Alpine is everywhere you do not look. It is a lightweight distribution, widely used for container images, minimal virtual machines and appliances. Many teams do not know that a network device, a backup tool or a test machine runs on Alpine. An inventory that stops at the main operating system will miss that SSH server.

"Passwordless" accounts become the door. The flaw targets precisely the accounts people consider safest, the ones that only accept a key. One account with a real password on the machine is enough to make all the others reachable.

The gap between disclosure and exploitation keeps shrinking. The OpenSSH notes say so: the team receives many reports of flaws found with AI help, and different researchers often find the same flaw independently. The team concludes that attackers can probably find them too, and will now ship fixes more often. For you, that means less time between the advisory and the need to act.

What we think at Sentrix

1. Find your SSH servers on musl. Look for Alpine hosts, and more broadly for musl-based images and appliances, that expose port 22. Our CTEM module links exposure to the actual system behind each port.
2. Update, then restart sshd. Alpine lists the fixed versions per branch. Restarting the daemon is the step people forget.
3. Turn off SSH password authentication. It is Alpine's workaround and good practice on its own: servers are managed with keys or certificates. Our endpoint and server security service builds this setting into hardening baselines.
4. Look for suspicious logins. Alpine recommends searching /var/log/messages for "Accepted password for" entries on accounts with no password, and reviewing doas, recent accounts and authorized keys. A machine where a login cannot be ruled out should be treated as compromised.
5. Ask your vendors. If an appliance ships OpenSSH on Alpine, the vendor has to deliver the fix. A software bill of materials lets you ask the question already knowing the answer.
6. Shorten the KEV loop. Three days separated the catalog listing from the federal deadline. Compare the KEV feed with your inventory every day, as our article on prioritizing patches with the KEV catalog describes, and run the cycle through our vulnerability and patch management service.

The next step

Run one search across all your hosts today for a single line: the effective PasswordAuthentication value in sshd. Every "yes" on an Alpine system needs fixing before the end of the week. To build that inventory with us, contact us.