OpenSSH fixes password bypass affecting Alpine Linux systems

OpenSSH released version 10.6p2 on 5 November 2026 to fix CVE-2026-123158, nicknamed “sshole”. The flaw can let a remote attacker log in to an account with no password, but only on Linux systems running OpenSSH with the musl C library and without PAM. Alpine Linux’s default OpenSSH server package meets those conditions. Alpine also issued fixes for branches 3.16 through edge on the same day.

The vulnerability has a CVSS 3.1 score of 8.1 (High); no in-the-wild attacks had been reported by 6 November, although CISA’s CVE enrichment listed exploitation status as proof of concept.

Exploitation requires password authentication to be enabled, an account whose password field contains “*”, and another local account with a $5$ or $6 password hash. An attacker sends a password longer than 256 bytes. According to researcher Özgün Kültekin and Alpine’s advisory, musl’s crypt() returns “*” for such passwords with these hash types; under the affected OpenSSH behaviour, that matches the passwordless account’s stored field and is accepted.

OpenSSH maintainer Damien Miller said glibc-based Linux distributions, non-Linux systems and systems using PAM to check passwords are not affected. Alpine’s default setting normally blocks direct password login to root, but the advisory warns that access to the “alpine” account on specified tiny-cloud images could enable root access through passwordless doas.

The permanent fix is to install the patched package and restart sshd; installing it alone leaves the old server process running. On Alpine, the recommended commands are `apk upgrade -U -a` and `rc-service sshd restart`. Disabling password authentication is a fallback. Alpine advises checking authentication logs for successful password logins to passwordless accounts and treating a machine as compromised if such access cannot be ruled out.