{"id":16288,"date":"2026-11-06T09:00:00","date_gmt":"2026-11-06T08:00:00","guid":{"rendered":"https:\/\/safewave.ai\/openssh-sshole-cve-2026-123158-excessively-long-password-opens-passwordless-accounts-on-alpine-linux-attacks-after-9-hours\/"},"modified":"2026-11-09T14:12:22","modified_gmt":"2026-11-09T13:12:22","slug":"openssh-sshole-cve-2026-123158-excessively-long-password-opens-passwordless-accounts-on-alpine-linux-attacks-after-9-hours","status":"publish","type":"post","link":"https:\/\/safewave.ai\/en\/openssh-sshole-cve-2026-123158-excessively-long-password-opens-passwordless-accounts-on-alpine-linux-attacks-after-9-hours\/","title":{"rendered":"OpenSSH \u201csshole\u201d (CVE-2026-123158): excessively long password opens passwordless accounts on Alpine Linux, attacks after 9 hours"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"16288\" class=\"elementor elementor-16288 elementor-16203\" data-elementor-post-type=\"post\">\n\t\t\t\t<header class=\"elementor-element elementor-element-6318433 e-flex e-con-boxed e-con e-parent\" data-id=\"6318433\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-6318674 elementor-widget elementor-widget-heading\" data-id=\"6318674\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<p class=\"elementor-heading-title elementor-size-default\"><a href=\"https:\/\/safewave.ai\/en\/applications-api-and-cloud\/\">Applications, API, and Cloud<\/a><\/p>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-63188bd elementor-widget elementor-widget-heading\" data-id=\"63188bd\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h1 class=\"elementor-heading-title elementor-size-default\">OpenSSH \u201csshole\u201d (CVE-2026-123158): excessively long password opens passwordless accounts on Alpine Linux, attacks after 9 hours<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6318e68 elementor-widget elementor-widget-text-editor\" data-id=\"6318e68\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>On November 5, 2026, OpenSSH released version 10.6p2 with a fix for CVE-2026-123158, dubbed \u201csshole.\u201d On systems using the musl library without PAM \u2013 including the default Alpine Linux package \u2013 a password longer than 256 characters allows logging into an account that has no password at all. The first attack attempt was observed less than 9 hours after the CVE was published.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6318a54 elementor-widget elementor-widget-html\" data-id=\"6318a54\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"html.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<ul class=\"sw-meta\"><li><span>Source<\/span><a href=\"https:\/\/www.helpnetsecurity.com\/2026\/11\/06\/openssh-sshole-cve-2026-123158-exploitation\/\" target=\"_blank\" rel=\"noopener\">Help Net Security<\/a><\/li><li><span>Source publication<\/span>November 6, 2026<\/li><li><span>Type<\/span>Threats and incidents<\/li><\/ul>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/header>\n\t\t<article class=\"elementor-element elementor-element-6318d04 e-flex e-con-boxed e-con e-parent\" data-id=\"6318d04\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-631841f elementor-widget elementor-widget-text-editor\" data-id=\"631841f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>What happened<\/h2><p>The mechanism combines two old design decisions. Since 2016, to avoid revealing the existence of accounts, sshd hashes the provided password with another account&#8217;s salt even when the target account has no usable hash. Meanwhile, since 2012, the crypt() function in the musl library rejects SHA-256 and SHA-512 passwords longer than 256 bytes and returns a \u201c*\u201d character. This character matches the \u201c*\u201d entry in the password field of passwordless accounts (e.g., accounts logging in only via SSH key or LDAP users), so sshd accepts the login. Systems with glibc (Debian, Ubuntu, Fedora), configurations with PAM, Dropbear, and OpenBSD are not vulnerable.<\/p><p>On November 6, Previdian recorded eight attempts from a single IP address in Japan; one was successful \u2013 a honeypot running genuine Alpine Linux and OpenSSH granted the attacker root privileges. At the time of publication, the vulnerability was not yet in the CISA KEV catalog. Proof-of-concept exploits are circulating on GitHub, which according to Previdian may contain malicious code.<\/p><h2>Key findings<\/h2><ul><li>Vulnerable: OpenSSH before 10.6p2 built with musl and without PAM, with password login enabled (enabled by default) and an account with \u201c*\u201d in the password field; affects default Alpine Linux, and according to the researcher, also OpenWrt, Buildroot, Yocto, and many container images.<\/li><li>Particularly at risk according to SOCRadar: Alpine tiny-cloud images for AWS and Azure in versions 3.18.11\u20133.24.3 \u2013 due to the default \u201calpine\u201d user having passwordless doas privileges.<\/li><li>Exploitation: first attempt less than 9 hours after CVE publication; successful root account takeover on a Previdian honeypot.<\/li><li>Patch: OpenSSH 10.6p2 and Alpine packages for branches from 3.16 to edge (11\/05\/2026); installation alone does not restart the running sshd process.<\/li><\/ul><h2>Why it matters<\/h2><div class=\"sw-take\"><span class=\"sw-take__k\">SafeWave Commentary<\/span>The vulnerability is trivial to exploit and affects exactly those systems most likely to be overlooked during inventory: containers, edge devices, and Alpine-based cloud images. Recommended steps: disable password login wherever possible (the OpenSSH maintainer recommended doing this immediately); update to 10.6p2 and restart sshd; review logs for successful password logins on passwordless accounts (alpine, root, key-only accounts), as well as new users, changes to authorized keys, and doas usage. If a compromise cannot be ruled out, the system must be treated as compromised. This is another example from this week that the window between disclosure and attack is measured in hours.<\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/article>\n\t\t<aside class=\"elementor-element elementor-element-6318f4a e-flex e-con-boxed e-con e-parent\" data-id=\"6318f4a\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-631871a elementor-widget elementor-widget-text-editor\" data-id=\"631871a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"sw-h\">Source<\/p><ul class=\"sw-src\"><li><a href=\"https:\/\/www.helpnetsecurity.com\/2026\/11\/06\/openssh-sshole-cve-2026-123158-exploitation\/\" target=\"_blank\" rel=\"noopener\">Help Net Security \u2013 OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158)<\/a><\/li><li><a href=\"https:\/\/www.securityweek.com\/openssh-rushes-patches-for-sshole-authentication-bypass\/\" target=\"_blank\" rel=\"noopener\">SecurityWeek \u2013 OpenSSH issues patches<\/a><\/li><li><a href=\"https:\/\/socradar.io\/blog\/sshole-openssh-password-bypass-alpine\/\" target=\"_blank\" rel=\"noopener\">SOCRadar \u2013 Analysis and detection tips<\/a><\/li><\/ul><p class=\"sw-rel\"><a href=\"https:\/\/safewave.ai\/en\/applications-api-and-cloud\/\">Area: Applications, API and Cloud \u2192<\/a><a href=\"https:\/\/safewave.ai\/en\/technology-intelligence\/\">All analyses \u2192<\/a><\/p><p class=\"sw-asof\">SafeWave editorial development based on the indicated source. Facts originate from the source; the \u201cWhy it matters\u201d section is our commentary.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/aside>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>CVE-2026-123158 \u201csshole\u201d: on Alpine Linux, a very long password opens passwordless accounts. Exploits appeared 9 hours after disclosure. What to patch and what to check in the logs.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"elementor_header_footer","format":"standard","meta":{"footnotes":""},"categories":[275],"tags":[],"class_list":["post-16288","post","type-post","status-publish","format-standard","hentry","category-applications-api-and-cloud"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>OpenSSH \u201csshole\u201d (CVE-2026-123158): excessively long password opens passwordless accounts on Alpine Linux, attacks after 9 hours &#8211; SafeWave<\/title>\n<meta name=\"description\" content=\"CVE-2026-123158 \u201csshole\u201d: on Alpine Linux, a very long password opens passwordless accounts. Exploits appeared 9 hours after disclosure. What to patch and what to check in the logs.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/safewave.ai\/en\/openssh-sshole-cve-2026-123158-excessively-long-password-opens-passwordless-accounts-on-alpine-linux-attacks-after-9-hours\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"OpenSSH \u201csshole\u201d (CVE-2026-123158): excessively long password opens passwordless accounts on Alpine Linux, attacks after 9 hours &#8211; SafeWave\" \/>\n<meta property=\"og:description\" content=\"CVE-2026-123158 \u201csshole\u201d: on Alpine Linux, a very long password opens passwordless accounts. Exploits appeared 9 hours after disclosure. What to patch and what to check in the logs.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/safewave.ai\/en\/openssh-sshole-cve-2026-123158-excessively-long-password-opens-passwordless-accounts-on-alpine-linux-attacks-after-9-hours\/\" \/>\n<meta property=\"og:site_name\" content=\"SafeWave\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-06T08:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-11-09T13:12:22+00:00\" \/>\n<meta name=\"author\" content=\"SafeWave\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"SafeWave\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/openssh-sshole-cve-2026-123158-excessively-long-password-opens-passwordless-accounts-on-alpine-linux-attacks-after-9-hours\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/openssh-sshole-cve-2026-123158-excessively-long-password-opens-passwordless-accounts-on-alpine-linux-attacks-after-9-hours\\\/\"},\"author\":{\"name\":\"SafeWave\",\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/#\\\/schema\\\/person\\\/9e9fc64ff61c418abb6f658be85dcf4a\"},\"headline\":\"OpenSSH \u201csshole\u201d (CVE-2026-123158): excessively long password opens passwordless accounts on Alpine Linux, attacks after 9 hours\",\"datePublished\":\"2026-11-06T08:00:00+00:00\",\"dateModified\":\"2026-11-09T13:12:22+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/openssh-sshole-cve-2026-123158-excessively-long-password-opens-passwordless-accounts-on-alpine-linux-attacks-after-9-hours\\\/\"},\"wordCount\":525,\"publisher\":{\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/#organization\"},\"articleSection\":[\"Applications, API, and Cloud\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/openssh-sshole-cve-2026-123158-excessively-long-password-opens-passwordless-accounts-on-alpine-linux-attacks-after-9-hours\\\/\",\"url\":\"https:\\\/\\\/safewave.ai\\\/en\\\/openssh-sshole-cve-2026-123158-excessively-long-password-opens-passwordless-accounts-on-alpine-linux-attacks-after-9-hours\\\/\",\"name\":\"OpenSSH \u201csshole\u201d (CVE-2026-123158): excessively long password opens passwordless accounts on Alpine Linux, attacks after 9 hours &#8211; SafeWave\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/#website\"},\"datePublished\":\"2026-11-06T08:00:00+00:00\",\"dateModified\":\"2026-11-09T13:12:22+00:00\",\"description\":\"CVE-2026-123158 \u201csshole\u201d: on Alpine Linux, a very long password opens passwordless accounts. Exploits appeared 9 hours after disclosure. What to patch and what to check in the logs.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/openssh-sshole-cve-2026-123158-excessively-long-password-opens-passwordless-accounts-on-alpine-linux-attacks-after-9-hours\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/safewave.ai\\\/en\\\/openssh-sshole-cve-2026-123158-excessively-long-password-opens-passwordless-accounts-on-alpine-linux-attacks-after-9-hours\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/openssh-sshole-cve-2026-123158-excessively-long-password-opens-passwordless-accounts-on-alpine-linux-attacks-after-9-hours\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/safewave.ai\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"OpenSSH \u201csshole\u201d (CVE-2026-123158): excessively long password opens passwordless accounts on Alpine Linux, attacks after 9 hours\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/safewave.ai\\\/en\\\/\",\"name\":\"SafeWave\",\"description\":\"We protect your AI models, data, applications, systems and users. Also in the cloud and based on cloud\",\"publisher\":{\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/#organization\"},\"alternateName\":\"SafeWave sp. z o.o.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/safewave.ai\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/#organization\",\"name\":\"SafeWave\",\"alternateName\":\"SafeWave sp. z o.o.\",\"url\":\"https:\\\/\\\/safewave.ai\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/safewave.ai\\\/wp-content\\\/uploads\\\/2022\\\/05\\\/SafeWave-BLACK_350.png\",\"contentUrl\":\"https:\\\/\\\/safewave.ai\\\/wp-content\\\/uploads\\\/2022\\\/05\\\/SafeWave-BLACK_350.png\",\"width\":350,\"height\":270,\"caption\":\"SafeWave\"},\"image\":{\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/company\\\/safewave-ai\",\"https:\\\/\\\/www.youtube.com\\\/@SafeWaveAI\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/#\\\/schema\\\/person\\\/9e9fc64ff61c418abb6f658be85dcf4a\",\"name\":\"SafeWave\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/65abcb7733e8dc7978eef52261952bdb2d6b542553675327aa0a3cfc74ee68bf?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/65abcb7733e8dc7978eef52261952bdb2d6b542553675327aa0a3cfc74ee68bf?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/65abcb7733e8dc7978eef52261952bdb2d6b542553675327aa0a3cfc74ee68bf?s=96&d=mm&r=g\",\"caption\":\"SafeWave\"},\"description\":\"Zesp\u00f3\u0142 SafeWave \u2013 cyberbezpiecze\u0144stwo i AI dla firm od 1998 roku. Analizy Technology Intelligence przygotowujemy z pomoc\u0105 AI i weryfikujemy redakcyjnie.\",\"sameAs\":[\"https:\\\/\\\/safewave.ai\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"OpenSSH \u201csshole\u201d (CVE-2026-123158): excessively long password opens passwordless accounts on Alpine Linux, attacks after 9 hours &#8211; SafeWave","description":"CVE-2026-123158 \u201csshole\u201d: on Alpine Linux, a very long password opens passwordless accounts. Exploits appeared 9 hours after disclosure. What to patch and what to check in the logs.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/safewave.ai\/en\/openssh-sshole-cve-2026-123158-excessively-long-password-opens-passwordless-accounts-on-alpine-linux-attacks-after-9-hours\/","og_locale":"en_US","og_type":"article","og_title":"OpenSSH \u201csshole\u201d (CVE-2026-123158): excessively long password opens passwordless accounts on Alpine Linux, attacks after 9 hours &#8211; SafeWave","og_description":"CVE-2026-123158 \u201csshole\u201d: on Alpine Linux, a very long password opens passwordless accounts. Exploits appeared 9 hours after disclosure. What to patch and what to check in the logs.","og_url":"https:\/\/safewave.ai\/en\/openssh-sshole-cve-2026-123158-excessively-long-password-opens-passwordless-accounts-on-alpine-linux-attacks-after-9-hours\/","og_site_name":"SafeWave","article_published_time":"2026-11-06T08:00:00+00:00","article_modified_time":"2026-11-09T13:12:22+00:00","author":"SafeWave","twitter_card":"summary_large_image","twitter_misc":{"Written by":"SafeWave","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/safewave.ai\/en\/openssh-sshole-cve-2026-123158-excessively-long-password-opens-passwordless-accounts-on-alpine-linux-attacks-after-9-hours\/#article","isPartOf":{"@id":"https:\/\/safewave.ai\/en\/openssh-sshole-cve-2026-123158-excessively-long-password-opens-passwordless-accounts-on-alpine-linux-attacks-after-9-hours\/"},"author":{"name":"SafeWave","@id":"https:\/\/safewave.ai\/en\/#\/schema\/person\/9e9fc64ff61c418abb6f658be85dcf4a"},"headline":"OpenSSH \u201csshole\u201d (CVE-2026-123158): excessively long password opens passwordless accounts on Alpine Linux, attacks after 9 hours","datePublished":"2026-11-06T08:00:00+00:00","dateModified":"2026-11-09T13:12:22+00:00","mainEntityOfPage":{"@id":"https:\/\/safewave.ai\/en\/openssh-sshole-cve-2026-123158-excessively-long-password-opens-passwordless-accounts-on-alpine-linux-attacks-after-9-hours\/"},"wordCount":525,"publisher":{"@id":"https:\/\/safewave.ai\/en\/#organization"},"articleSection":["Applications, API, and Cloud"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/safewave.ai\/en\/openssh-sshole-cve-2026-123158-excessively-long-password-opens-passwordless-accounts-on-alpine-linux-attacks-after-9-hours\/","url":"https:\/\/safewave.ai\/en\/openssh-sshole-cve-2026-123158-excessively-long-password-opens-passwordless-accounts-on-alpine-linux-attacks-after-9-hours\/","name":"OpenSSH \u201csshole\u201d (CVE-2026-123158): excessively long password opens passwordless accounts on Alpine Linux, attacks after 9 hours &#8211; SafeWave","isPartOf":{"@id":"https:\/\/safewave.ai\/en\/#website"},"datePublished":"2026-11-06T08:00:00+00:00","dateModified":"2026-11-09T13:12:22+00:00","description":"CVE-2026-123158 \u201csshole\u201d: on Alpine Linux, a very long password opens passwordless accounts. Exploits appeared 9 hours after disclosure. What to patch and what to check in the logs.","breadcrumb":{"@id":"https:\/\/safewave.ai\/en\/openssh-sshole-cve-2026-123158-excessively-long-password-opens-passwordless-accounts-on-alpine-linux-attacks-after-9-hours\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/safewave.ai\/en\/openssh-sshole-cve-2026-123158-excessively-long-password-opens-passwordless-accounts-on-alpine-linux-attacks-after-9-hours\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/safewave.ai\/en\/openssh-sshole-cve-2026-123158-excessively-long-password-opens-passwordless-accounts-on-alpine-linux-attacks-after-9-hours\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/safewave.ai\/en\/"},{"@type":"ListItem","position":2,"name":"OpenSSH \u201csshole\u201d (CVE-2026-123158): excessively long password opens passwordless accounts on Alpine Linux, attacks after 9 hours"}]},{"@type":"WebSite","@id":"https:\/\/safewave.ai\/en\/#website","url":"https:\/\/safewave.ai\/en\/","name":"SafeWave","description":"We protect your AI models, data, applications, systems and users. Also in the cloud and based on cloud","publisher":{"@id":"https:\/\/safewave.ai\/en\/#organization"},"alternateName":"SafeWave sp. z o.o.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/safewave.ai\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/safewave.ai\/en\/#organization","name":"SafeWave","alternateName":"SafeWave sp. z o.o.","url":"https:\/\/safewave.ai\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/safewave.ai\/en\/#\/schema\/logo\/image\/","url":"https:\/\/safewave.ai\/wp-content\/uploads\/2022\/05\/SafeWave-BLACK_350.png","contentUrl":"https:\/\/safewave.ai\/wp-content\/uploads\/2022\/05\/SafeWave-BLACK_350.png","width":350,"height":270,"caption":"SafeWave"},"image":{"@id":"https:\/\/safewave.ai\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.linkedin.com\/company\/safewave-ai","https:\/\/www.youtube.com\/@SafeWaveAI"]},{"@type":"Person","@id":"https:\/\/safewave.ai\/en\/#\/schema\/person\/9e9fc64ff61c418abb6f658be85dcf4a","name":"SafeWave","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/65abcb7733e8dc7978eef52261952bdb2d6b542553675327aa0a3cfc74ee68bf?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/65abcb7733e8dc7978eef52261952bdb2d6b542553675327aa0a3cfc74ee68bf?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/65abcb7733e8dc7978eef52261952bdb2d6b542553675327aa0a3cfc74ee68bf?s=96&d=mm&r=g","caption":"SafeWave"},"description":"Zesp\u00f3\u0142 SafeWave \u2013 cyberbezpiecze\u0144stwo i AI dla firm od 1998 roku. Analizy Technology Intelligence przygotowujemy z pomoc\u0105 AI i weryfikujemy redakcyjnie.","sameAs":["https:\/\/safewave.ai"]}]}},"_links":{"self":[{"href":"https:\/\/safewave.ai\/en\/wp-json\/wp\/v2\/posts\/16288","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/safewave.ai\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/safewave.ai\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/safewave.ai\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/safewave.ai\/en\/wp-json\/wp\/v2\/comments?post=16288"}],"version-history":[{"count":2,"href":"https:\/\/safewave.ai\/en\/wp-json\/wp\/v2\/posts\/16288\/revisions"}],"predecessor-version":[{"id":16564,"href":"https:\/\/safewave.ai\/en\/wp-json\/wp\/v2\/posts\/16288\/revisions\/16564"}],"wp:attachment":[{"href":"https:\/\/safewave.ai\/en\/wp-json\/wp\/v2\/media?parent=16288"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/safewave.ai\/en\/wp-json\/wp\/v2\/categories?post=16288"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/safewave.ai\/en\/wp-json\/wp\/v2\/tags?post=16288"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}