high severityConfidence highHistorical record

OpenSSH SSHole on Alpine Linux: any very long password logs in to accounts with no password set (CVE-2026-123158)

Direct answer

OpenSSH SSHole on Alpine Linux: any very long password logs in to accounts with no password set (CVE-2026-123158), also tracked as CVE-2026-123158 / SSHole / OpenSSH 10.6p2 is a high-severity threat campaign HOL Guard tracked from Nov 6, 2026 to Nov 9, 2026, verified against 7 primary sources and last reviewed Nov 9, 2026. Active tracking has ended and the record remains published as a permanent historical research record.

CVE-2026-123158 (SSHole) lets an attacker log in over SSH to an account that has no password set by sending any password between 257 and 1024 bytes. It affects OpenSSH sshd built without PAM on musl-based systems such as Alpine Linux: musl's crypt() returns the string * for inputs over 256 bytes, which matches the * stored for no-password accounts in the shadow file. Exposure needs PasswordAuthentication yes, PAM off, at least one no-password account that can log in, and at least one normal password hash on the box. OpenSSH 10.6p2 (Nov 5, 2026) works around it in sshd, and Alpine shipped patched openssh packages back to 3.16. CISA added it to the Known Exploited Vulnerabilities catalog on Nov 9, 2026 with a Nov 12 deadline, and SecurityWeek reports exploitation attempts from Nov 6.

Also tracked as CVE-2026-123158 · SSHole · OpenSSH 10.6p2 · Alpine OpenSSH password authentication bypass · musl crypt OpenSSH bypass

First observed
Nov 6, 2026
Last observed
Nov 9, 2026
Last reviewed
Nov 9, 2026
Tracking ended
Nov 9, 2026

Record exports

JSON recordArtifact CSVSTIX 2.1 bundle

Uncertainty and limitations

Read the evidence limits before acting on this record.

Public exploitation reporting comes from third-party sensors cited by SecurityWeek; counts are small and early. Exposure depends on per-host configuration (PAM, password authentication, account setup), so not every Alpine host running sshd is exploitable.

  • Glibc distributions such as Debian, Ubuntu and RHEL are not named in any advisory; the bug needs musl crypt() behavior.
  • Alpine hosts using openssh-server-pam with UsePAM yes, or with PasswordAuthentication no, are not affected.
  • Alpine-based containers that do not run sshd are not affected.
  • Root is protected by the default PermitRootLogin prohibit-password unless changed.
  • This is a login bypass, not remote code execution and not a flaw in the SSH protocol.

Guard coverage and policy

What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.

No Guard coverage mapping or campaign-specific policy guidance is published for this record.

Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

Open policy controlsCampaign-specific emergency policy starting point

Timeline

Reviewed events, oldest first, each tied to a verified source.

  1. Vendor action

    OpenSSH 10.6p2 released with an sshd workaround for musl crypt() returning * on long inputs.

    Sources:OpenSSH 10.6p2 release notes·openssh-portable commit 4353fdc (sshd workaround)

  2. Disclosure

    Alpine published the advisory with patched openssh packages for edge and 3.16 through 3.24.

    Source:Alpine Linux advisory: OpenSSH password authentication bypass

  3. First observed

    SecurityWeek reports sensors logged exploitation attempts between Nov 6 and Nov 8.

    Source:SecurityWeek: Hackers Exploiting SSHole Authentication Bypass in OpenSSH

  4. Update

    CISA added CVE-2026-123158 to the KEV catalog with a Nov 12, 2026 due date.

    Source:CISA KEV entry CVE-2026-123158

  5. Guard update

    HOL published the operator write-up with fix steps and a host check.

    Source:HOL blog write-up

Publication clock: 113.5 hours from reviewed disclosure timestamp to HOL publication; 24-hour high target; historical backfill outside target.

Sources

Every claim on this record is traceable to the sources below.

Campaign questions, answered

CVE-2026-123158 (SSHole) lets an attacker log in over SSH to an account that has no password set by sending any password between 257 and 1024 bytes. It affects OpenSSH sshd built without PAM on musl-based systems such as Alpine Linux: musl's crypt() returns the string * for inputs over 256 bytes, which matches the * stored for no-password accounts in the shadow file. HOL Guard tracked the campaign from Nov 6, 2026 to Nov 9, 2026.

No. Active tracking ended Nov 9, 2026; this page remains as a labeled historical research record and does not imply the threat is currently active.

The record cites 7 primary sources, names 0 reviewed artifacts, and was last fully reviewed Nov 9, 2026 by HOL Guard Security Publishing. Its uncertainty and limitations are stated on the record itself.

Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

The permalink above is permanent. The full record can be downloaded from this page as JSON, an artifact CSV, and a STIX 2.1 bundle, and corrections can be requested through the published correction path on the record. Public exploitation reporting comes from third-party sensors cited by SecurityWeek; counts are small and early.

Reviewed in full by HOL Guard Security Publishing.

Published
Last full review
Last modified

Report a correction

Record HGTC-2026-37CF900A