Applications, API, and Cloud

OpenSSH “sshole” (CVE-2026-123158): excessively long password opens passwordless accounts on Alpine Linux, attacks after 9 hours

On November 5, 2026, OpenSSH released version 10.6p2 with a fix for CVE-2026-123158, dubbed “sshole.” On systems using the musl library without PAM – including the default Alpine Linux package – a password longer than 256 characters allows logging into an account that has no password at all. The first attack attempt was observed less than 9 hours after the CVE was published.

What happened

The mechanism combines two old design decisions. Since 2016, to avoid revealing the existence of accounts, sshd hashes the provided password with another account’s salt even when the target account has no usable hash. Meanwhile, since 2012, the crypt() function in the musl library rejects SHA-256 and SHA-512 passwords longer than 256 bytes and returns a “*” character. This character matches the “*” entry in the password field of passwordless accounts (e.g., accounts logging in only via SSH key or LDAP users), so sshd accepts the login. Systems with glibc (Debian, Ubuntu, Fedora), configurations with PAM, Dropbear, and OpenBSD are not vulnerable.

On November 6, Previdian recorded eight attempts from a single IP address in Japan; one was successful – a honeypot running genuine Alpine Linux and OpenSSH granted the attacker root privileges. At the time of publication, the vulnerability was not yet in the CISA KEV catalog. Proof-of-concept exploits are circulating on GitHub, which according to Previdian may contain malicious code.

Key findings

  • Vulnerable: OpenSSH before 10.6p2 built with musl and without PAM, with password login enabled (enabled by default) and an account with “*” in the password field; affects default Alpine Linux, and according to the researcher, also OpenWrt, Buildroot, Yocto, and many container images.
  • Particularly at risk according to SOCRadar: Alpine tiny-cloud images for AWS and Azure in versions 3.18.11–3.24.3 – due to the default “alpine” user having passwordless doas privileges.
  • Exploitation: first attempt less than 9 hours after CVE publication; successful root account takeover on a Previdian honeypot.
  • Patch: OpenSSH 10.6p2 and Alpine packages for branches from 3.16 to edge (11/05/2026); installation alone does not restart the running sshd process.

Why it matters

SafeWave CommentaryThe vulnerability is trivial to exploit and affects exactly those systems most likely to be overlooked during inventory: containers, edge devices, and Alpine-based cloud images. Recommended steps: disable password login wherever possible (the OpenSSH maintainer recommended doing this immediately); update to 10.6p2 and restart sshd; review logs for successful password logins on passwordless accounts (alpine, root, key-only accounts), as well as new users, changes to authorized keys, and doas usage. If a compromise cannot be ruled out, the system must be treated as compromised. This is another example from this week that the window between disclosure and attack is measured in hours.