sshole: OpenSSH Fixes Password Bypass on Alpine Linux

Socradar •Yağmur Ernalbant • November 6, 2026

OpenSSH has shipped an emergency release, version 10.6p2, to stop a password bypass that lets a remote attacker log in to accounts that have no password set. The flaw, tracked as CVE-2026-123158 and nicknamed “sshole,” affects Linux systems that run OpenSSH on the musl C library with PAM disabled. That combination is the default openssh-server […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical OpenSSH Vulnerability Allows Password Bypass on Alpine Linux On November 5, 2026, OpenSSH released version 10.6p2 to address CVE-2026-123158, a critical vulnerability that allows attackers to bypass password authentication on Alpine Linux and other musl-based systems. The flaw, discovered by Özgün Kültekin, enables unauthorized access to accounts with no password set by submitting a long password (between 257 and 1024 characters). This issue primarily affects systems running OpenSSH without PAM (Pluggable Authentication Modules) and where password authentication is enabled. The vulnerability has been confirmed to impact Alpine Linux cloud images, which often include a default 'alpine' user that can gain root access without a password. As of November 6, 2026, reports indicate that exploitation attempts have already been observed in the wild. Administrators are urged to apply the patch immediately or disable password authentication to mitigate risks. 39 sources 72

Extracted Entities

sshole: OpenSSH Fixes Password Bypass on Alpine Linux

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

Platforms (2)

Vulnerabilities (1)