**CVE-2026-123158**, also known as **SSHhole**, is a password authentication bypass vulnerability affecting OpenSSH servers running on certain Linux configurations using musl libc without PAM support.
The vulnerability occurs because of an interaction between OpenSSH password verification and the error-handling behavior of musl libc's `crypt()` function.
Under specific account configurations, an attacker may authenticate using an incorrectly supplied password between 256 and 1024 characters.
Successful exploitation can result in unauthorized SSH access.
| Vulnerability Type | Authentication Bypass |
| Affected Environment | Linux without PAM |
The vulnerability requires a specific combination of conditions.
- OpenSSH servers built or configured without PAM.
- Accounts with password fields containing `*`.
- Applicable account and password-hash configurations.
Examples of potentially affected environments:
**Important:** The presence of musl libc alone does not establish vulnerability. All relevant conditions must be evaluated.
- OpenSSH using PAM for password authentication.
- Systems using glibc rather than musl for this authentication path.
- OpenSSH versions containing the upstream security fix.
The issue involves the interaction between:
When a password exceeds musl's supported input length, `crypt()` can return `*` to indicate an error.
Some Unix account configurations also use `*` as the stored password field for accounts that cannot authenticate using a password.
In the affected OpenSSH authentication path, these values can be incorrectly interpreted as a successful password match.
The underlying problem can be represented conceptually:
This behavior depends on the affected account configuration and runtime environment.
- Unauthorized modification of system data.
- Access to accounts intended for key-based authentication only.
- Further privilege escalation where additional permissions are available.
**Note:** Root access is not automatic. The resulting privileges depend on the account and system configuration.
The following commands are intended for authorized system auditing.
On Alpine Linux, musl is the standard C library.
### 4. Inspect SSH authentication configuration
sudo sshd -T | grep -Ei 'usepam|passwordauthentication'
These values indicate potentially relevant conditions, not confirmed exploitability.
### 5. Inspect the installed Alpine package
Compare the installed package revision against the official Alpine security advisory.
sudo grep 'Accepted password' /var/log/messages
Investigate unexpected successful password logins, especially involving accounts intended to use SSH keys only.
Upgrade to **OpenSSH 10.6p2 or later**, or install the corresponding security-patched package supplied by your Linux distribution.
Verify the installed package revision after updating.
If immediate patching is not possible, disable SSH password authentication.
**Warning:** Confirm that SSH key-based access works before disabling password authentication. Keep an existing administrative session open while testing to avoid locking yourself out.
- [ ] Identify OpenSSH versions and package revisions.
- [ ] Review password authentication settings.
- [ ] Identify accounts with passwordless or locked password fields.
- [ ] Investigate suspicious successful logins.
- [ ] Validate SSH key-based authentication.
| Vulnerable test environment | Alpine Linux |
Only perform security testing against systems you own or have explicit permission to assess.
1. [MITRE CVE-2026-123158](
2. [OpenSSH 10.6p2 Release Notes](
3. [OpenSSH Official Security Fix](
4. [Alpine Linux Security Advisory](
5. [CVE Details — OpenCVE](
This repository is intended for educational purposes, defensive security research, vulnerability assessment, and authorized penetration testing.
Do not use this research to access systems without explicit authorization.
The author is not responsible for misuse of the information provided.
Security Research | Linux | OpenSSH | Vulnerability Analysis
Stay curious. Stay ethical. Stay secure. 🔐
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
