{
  "schemaVersion": "guard-threat-campaign/v1",
  "id": "HGTC-2026-37CF900A",
  "slug": "cve-2026-123158-openssh-sshole-alpine-password-bypass",
  "title": "OpenSSH SSHole on Alpine Linux: any very long password logs in to accounts with no password set (CVE-2026-123158)",
  "aliases": [
    "CVE-2026-123158",
    "SSHole",
    "OpenSSH 10.6p2",
    "Alpine OpenSSH password authentication bypass",
    "musl crypt OpenSSH bypass"
  ],
  "summary": "CVE-2026-123158 (SSHole) lets an attacker log in over SSH to an account that has no password set by sending any password between 257 and 1024 bytes. It affects OpenSSH sshd built without PAM on musl-based systems such as Alpine Linux: musl's crypt() returns the string * for inputs over 256 bytes, which matches the * stored for no-password accounts in the shadow file. Exposure needs PasswordAuthentication yes, PAM off, at least one no-password account that can log in, and at least one normal password hash on the box. OpenSSH 10.6p2 (Nov 5, 2026) works around it in sshd, and Alpine shipped patched openssh packages back to 3.16. CISA added it to the Known Exploited Vulnerabilities catalog on Nov 9, 2026 with a Nov 12 deadline, and SecurityWeek reports exploitation attempts from Nov 6.",
  "status": "published",
  "severity": "high",
  "confidence": "high",
  "uncertainty": "Public exploitation reporting comes from third-party sensors cited by SecurityWeek; counts are small and early. Exposure depends on per-host configuration (PAM, password authentication, account setup), so not every Alpine host running sshd is exploitable.",
  "firstObservedAt": "2026-11-06T00:00:00Z",
  "lastObservedAt": "2026-11-09T00:00:00Z",
  "publishedAt": "2026-11-09T17:29:21.789Z",
  "reviewedAt": "2026-11-09T17:29:13.262Z",
  "expiresAt": "2026-11-09T00:00:00Z",
  "reviewer": "HOL Guard Security Publishing",
  "sources": [
    {
      "id": "openssh-release-notes",
      "label": "OpenSSH 10.6p2 release notes",
      "url": "https://www.openssh.org/releasenotes.html#10.6p2",
      "sourceType": "maintainer_advisory",
      "observedAt": "2026-11-09T00:00:00Z"
    },
    {
      "id": "openssh-portable-commit",
      "label": "openssh-portable commit 4353fdc (sshd workaround)",
      "url": "https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482",
      "sourceType": "other_primary",
      "observedAt": "2026-11-09T00:00:00Z"
    },
    {
      "id": "alpine-advisory",
      "label": "Alpine Linux advisory: OpenSSH password authentication bypass",
      "url": "https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-11-09T00:00:00Z"
    },
    {
      "id": "nvd",
      "label": "NVD CVE-2026-123158",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123158",
      "sourceType": "vulnerability_database",
      "observedAt": "2026-11-09T00:00:00Z"
    },
    {
      "id": "cisa-kev",
      "label": "CISA KEV entry CVE-2026-123158",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-123158",
      "sourceType": "government",
      "observedAt": "2026-11-09T00:00:00Z"
    },
    {
      "id": "securityweek",
      "label": "SecurityWeek: Hackers Exploiting SSHole Authentication Bypass in OpenSSH",
      "url": "https://www.securityweek.com/hackers-exploiting-sshole-authentication-bypass-in-openssh/",
      "sourceType": "research",
      "observedAt": "2026-11-09T00:00:00Z"
    },
    {
      "id": "hol-blog",
      "label": "HOL blog write-up",
      "url": "https://hol.org/blog/cve-2026-123158-openssh-sshole-alpine-password-bypass",
      "sourceType": "other_primary",
      "observedAt": "2026-11-09T00:00:00Z"
    }
  ],
  "artifacts": [],
  "indicators": [],
  "timeline": [
    {
      "id": "openssh-10-6p2-released",
      "occurredAt": "2026-11-05T00:00:00Z",
      "eventType": "vendor_action",
      "summary": "OpenSSH 10.6p2 released with an sshd workaround for musl crypt() returning * on long inputs.",
      "sourceIds": [
        "openssh-release-notes",
        "openssh-portable-commit"
      ]
    },
    {
      "id": "alpine-advisory-published",
      "occurredAt": "2026-11-05T00:00:00Z",
      "eventType": "disclosure",
      "summary": "Alpine published the advisory with patched openssh packages for edge and 3.16 through 3.24.",
      "sourceIds": [
        "alpine-advisory"
      ]
    },
    {
      "id": "exploitation-attempts-observed",
      "occurredAt": "2026-11-06T00:00:00Z",
      "eventType": "first_observed",
      "summary": "SecurityWeek reports sensors logged exploitation attempts between Nov 6 and Nov 8.",
      "sourceIds": [
        "securityweek"
      ]
    },
    {
      "id": "cisa-kev-added",
      "occurredAt": "2026-11-09T00:00:00Z",
      "eventType": "other",
      "summary": "CISA added CVE-2026-123158 to the KEV catalog with a Nov 12, 2026 due date.",
      "sourceIds": [
        "cisa-kev"
      ]
    },
    {
      "id": "hol-blog-published",
      "occurredAt": "2026-11-09T17:21:02Z",
      "eventType": "guard_update",
      "summary": "HOL published the operator write-up with fix steps and a host check.",
      "sourceIds": [
        "hol-blog"
      ]
    }
  ],
  "coverage": [],
  "policies": [],
  "limitations": [
    "Glibc distributions such as Debian, Ubuntu and RHEL are not named in any advisory; the bug needs musl crypt() behavior.",
    "Alpine hosts using openssh-server-pam with UsePAM yes, or with PasswordAuthentication no, are not affected.",
    "Alpine-based containers that do not run sshd are not affected.",
    "Root is protected by the default PermitRootLogin prohibit-password unless changed.",
    "This is a login bypass, not remote code execution and not a flaw in the SSH protocol."
  ],
  "correctionHref": "/guard/security/campaigns/cve-2026-123158-openssh-sshole-alpine-password-bypass/corrections"
}