OpenSSH "SSHole" Authentication Bypass: What Alpine and musl Linux Teams Must Patch Now

The flaw, tracked as CVE-2026-123158 and rated 8.1 (high), was reported by SecurityWeek on November 6, 2026, with a technical write-up from Orca Security dated November 5. Both describe the same affected configuration and the same fix.

What Happened

Researcher Özgün Kültekin of Wakefield found that sshd can misread a stored value as a password hash on affected systems. Certain accounts, such as root, can then be logged into with a long password even though they should not accept password logins.

According to the reports, the trigger is a password of roughly 257 to 1,024 characters. The fix shipped in OpenSSH 10.6p2, and Alpine published patched packages for its supported branches the same week. OpenSSH developer Damien Miller reportedly said the root cause lies partly in how sshd is used, not only in sshd code, and that the project shipped the fix quickly.

Who Is Affected

Exposure requires a specific combination of settings, so most Linux servers are not vulnerable. The reports say affected hosts run sshd on musl libc with PAM disabled, password authentication enabled and at least one account whose password field is an asterisk.

• Affected: Alpine Linux releases 3.16 through 3.24 and edge, and potentially other musl-based systems such as OpenWrt, Buildroot, Yocto and some container images.
• Needs all of: PAM disabled, PasswordAuthentication enabled, an account with "*" as its password field (common for root or key-only accounts), and at least one other local account with a SHA-256 or SHA-512 password hash.
• Not affected: glibc distributions such as Debian, Ubuntu and Fedora, PAM-enabled sshd, and Dropbear, per the Orca analysis.

Why It Matters for B2B Teams

Alpine is widely used as a small base image for containers, appliances and network equipment, so the flaw can hide in places teams do not manage like servers. Because attack details are public, security vendors expect scanning attempts quickly.

As of the reports, no exploitation had been confirmed. Researchers at Detectify and WatchTowr told SecurityWeek they expected scanning within hours or by the weekend. Internet-facing hosts with password login enabled are the most exposed, and SSH on port 22 is among the most scanned services online.

What to Do Now

Treat this as a same-day task for any Alpine or musl host reachable over SSH. Patch first, restart the daemon, then verify that password logins are really off for accounts that should only use keys.

• Update OpenSSH to 10.6p2 or the patched Alpine package for your branch, then restart sshd, because the running daemon keeps the old code until it is restarted.
• If you cannot patch, set PasswordAuthentication no in sshd_config and restart sshd.
• Search authentication logs for "Accepted password for" entries on accounts that have no password, and treat any match as a possible compromise.
• Rebuild container images and appliance firmware that embed an Alpine OpenSSH server.
• Restrict SSH exposure with firewall rules, VPN or bastion hosts, and use key-based authentication with MFA where possible.

How to Find Exposed Hosts

Start from your asset inventory, then confirm with scans. Look for Alpine and musl-based images, appliances and embedded systems that run sshd, including ones in CI runners and edge devices.

Vulnerability scanners and configuration tools help here. Our guides to vulnerability management tools and configuration management software compare options, and you can browse the Vulnerability Management Software category and Network Security Software category directly. A configuration tool can enforce PasswordAuthentication no across a fleet in one change.

Bottom Line

SSHole is narrow in scope but serious where it applies: a single connection can reach root on exposed, misconfigured musl systems. The fix is available, so verify exposure, patch, restart sshd and disable password logins before scanners find you.

Sources: reporting by SecurityWeek (November 6, 2026) and Orca Security (November 5, 2026). Details may be updated as vendors publish further advisories, so check your distribution's security notices.

Frequently Asked Questions

Is my Ubuntu or Debian server affected by SSHole?
No, according to the published analyses. The flaw affects sshd on musl libc systems such as Alpine with PAM disabled. Glibc distributions like Debian, Ubuntu and Fedora, and servers using PAM, are not affected, but you should still keep OpenSSH updated.

How do I fix the OpenSSH SSHole vulnerability?
Upgrade to OpenSSH 10.6p2 or your distribution's patched package, then restart sshd so the new code runs. If you cannot patch immediately, set PasswordAuthentication to no in sshd_config and restart the service until you can update.

Has the SSHole flaw been exploited in the wild?
As of the November 5 and 6, 2026 reports, no exploitation had been confirmed. Because details are public and the attack is simple, researchers expect scanning attempts, so patch quickly and review authentication logs for unexpected password logins.