CriticalCVECVE-2026-123158
sshole: OpenSSH Fixes Password Bypass on Alpine Linux
SOCRadar·Source published ·1 min read·Video available
Advisory videoOpen on YouTube ↗
What happened?
OpenSSH has shipped an emergency release, version 10.6p2, to stop a password bypass that lets a remote attacker log in to accounts that have no password set. The flaw, tracked as CVE-2026-123158 and nicknamed “sshole,” affects Linux systems that run OpenSSH on the musl C library with PAM disabled. That combination is the default openssh-server package on Alpine Linux. Alpine published fixed packages for every branch from 3.16 to edge on November 5, 2026, the same day as the OpenSSH release.
Key details
- OpenSSH released version 10.6p2 to fix a password bypass flaw nicknamed sshole that allows remote login to accounts with no password set.
- The vulnerability affects OpenSSH on Linux systems using musl C library with PAM disabled, which is the default on Alpine Linux.
- Alpine Linux published fixed packages for all branches from 3.16 to edge on November 5, 2026, the same day as the OpenSSH release.
Affected
- OpenSSH versions before 10.6p2 on Linux with musl libc and PAM disabled.
- Alpine Linux default openssh-server package (all branches 3.16 through edge).
- Other musl-based systems like OpenWrt, Buildroot, and Yocto where OpenSSH server is installed without PAM.
Fixes and mitigations
- Upgrade to OpenSSH 10.6p2 and restart sshd service to load the patched binary.
What to look for
- Follow-on activity such as doas usage, newly created users, or modifications to authorized_keys files.
Summarised by SecOraLens from SOCRadar. Always read the original source before acting. How SecOraLens verifies advisories.