{"type":"bundle","id":"bundle--8abc60c8-5fde-5ce9-9d87-329671a81e43","objects":[{"type":"campaign","spec_version":"2.1","id":"campaign--a9a4b5bf-001e-544f-9807-f544b5ab8be7","created":"2026-11-09T17:29:21.789Z","modified":"2026-11-09T17:29:21.789Z","name":"OpenSSH SSHole on Alpine Linux: any very long password logs in to accounts with no password set (CVE-2026-123158)","description":"CVE-2026-123158 (SSHole) lets an attacker log in over SSH to an account that has no password set by sending any password between 257 and 1024 bytes. It affects OpenSSH sshd built without PAM on musl-based systems such as Alpine Linux: musl's crypt() returns the string * for inputs over 256 bytes, which matches the * stored for no-password accounts in the shadow file. Exposure needs PasswordAuthentication yes, PAM off, at least one no-password account that can log in, and at least one normal password hash on the box. OpenSSH 10.6p2 (Nov 5, 2026) works around it in sshd, and Alpine shipped patched openssh packages back to 3.16. CISA added it to the Known Exploited Vulnerabilities catalog on Nov 9, 2026 with a Nov 12 deadline, and SecurityWeek reports exploitation attempts from Nov 6.","aliases":["CVE-2026-123158","SSHole","OpenSSH 10.6p2","Alpine OpenSSH password authentication bypass","musl crypt OpenSSH bypass"],"first_seen":"2026-11-06T00:00:00Z","last_seen":"2026-11-09T00:00:00Z","objective":"Defensive public threat-intelligence record; see limitations and source references.","external_references":[{"source_name":"OpenSSH 10.6p2 release notes","url":"https://www.openssh.org/releasenotes.html#10.6p2"},{"source_name":"openssh-portable commit 4353fdc (sshd workaround)","url":"https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482"},{"source_name":"Alpine Linux advisory: OpenSSH password authentication bypass","url":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/"},{"source_name":"NVD CVE-2026-123158","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123158"},{"source_name":"CISA KEV entry CVE-2026-123158","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-123158"},{"source_name":"SecurityWeek: Hackers Exploiting SSHole Authentication Bypass in OpenSSH","url":"https://www.securityweek.com/hackers-exploiting-sshole-authentication-bypass-in-openssh/"},{"source_name":"HOL blog write-up","url":"https://hol.org/blog/cve-2026-123158-openssh-sshole-alpine-password-bypass"}]}]}