AI and security briefsSecurity

Is my Linux server exposed to the OpenSSH sshole flaw, CVE-2026-123158?

By Brandon Da Costa, founder of Digiton Dynamics

Published 9 November 2026Updated 9 November 2026Editorial policy

CVE-2026-123158, nicknamed sshole, lets an attacker log in over SSH to accounts that have no password, on Linux systems that use the musl C library and run OpenSSH without PAM. Alpine Linux is the main case. OpenSSH fixed it in 10.6p2 on 5 November 2026, and CISA listed it as exploited on 9 November.

Who should act: Anyone running Alpine Linux, OpenWrt, Buildroot, Yocto or a musl-based container image with sshd, above all where password logins are on and a key-only account exists.

What happened

Ozgun Kultekin of Wakefield reported the bug. OpenSSH fixed it in portable release 10.6p2 on 5 November 2026 and calls it a password authentication bypass whose root cause sits outside sshd (OpenSSH release notes, 5 November). Alpine shipped patched packages the same day (Alpine Linux advisory, 5 November).

The mechanism is short. Without PAM, sshd hashes the typed password with crypt() and compares it to the shadow field. For an account whose field is just *, sshd borrows another account's salt. musl's crypt() returns * for oversized input, which matches the stored *, so the login succeeds (Alpine advisory). Alpine puts the working length at 257 to 1024 bytes.

Attacks followed fast. Previdian saw a first attempt under nine hours after the CVE was published and confirmed root on an Alpine honeypot (Help Net Security, 6 November). By 9 November Previdian counted 20 attempts from 13 addresses, GreyNoise reported a group it tracks as GT10 installing a backdoor called TAC Agent, and watchTowr saw botnet and crypto activity (Ars Technica, 9 November).

Sources disagree on KEV status. Help Net Security said on 6 November that CISA had not listed the bug. CISA's catalog now does, added 9 November with a 12 November due date (CISA KEV).

Who is affected

• OpenSSH before 10.6p2 on Linux with musl and no PAM (NVD, 9 November). Alpine's default openssh-server qualifies, and so does openssh-server-pam with UsePAM no. Kultekin also names OpenWrt, Buildroot, Yocto and some Docker images (Help Net Security).
• All three must hold: PasswordAuthentication yes (the default), an account with * in /etc/shadow, and at least one other account with a $5$ or $6$ hash (Alpine advisory). The * accounts include root, key-only users, directory users via musl-nscd and the alpine user on tiny-cloud images.
• Root is shielded by the default PermitRootLogin setting. The alpine user on official AWS and Azure images 3.18.11 to 3.24.3 has passwordless doas, so reaching it means root.
• Debian, Ubuntu and Fedora (glibc), PAM builds, Dropbear, OpenBSD and containers without sshd are unaffected (Alpine advisory).

What we checked

Run on 9 November 2026 on the Mac that builds this site. Each command and its output are copied as they ran.

$ curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json | jq -r '.vulnerabilities[] | select(.cveID=="CVE-2026-123158") | "\(.cveID) added \(.dateAdded) due \(.dueDate)"'
CVE-2026-123158 added 2026-11-09 due 2026-11-12

CISA's feed lists the bug as of today, a change from the 6 November coverage that said it was absent.

Check your exposure

Run as root on each host. You are exposed when musl is present, libpam is absent, password authentication is on and both awk lists return a name.

ssh -V
ldd --version 2>&1 | head -1
ldd "$(command -v sshd)" | grep -E 'musl|libpam'
sshd -T | grep -Ei '^(usepam|passwordauthentication|permitrootlogin)'
awk -F: '$2=="*"{print $1}' /etc/shadow
awk -F: '$2 ~ /^\$[56]\$/{print $1}' /etc/shadow

What to do now

1. Patch and restart. Upgrading does not restart a running sshd, so the old binary keeps answering until you do (Alpine advisory). Fixed Alpine packages are 10.6_p2-r0 on edge, 10.3_p1-r2 on 3.24.

   apk upgrade -U -a
   rc-service sshd restart

2. If you cannot patch today, turn off password logins. Alpine says either step closes the hole. Keep one session open and test a key login first.

   echo 'PasswordAuthentication no' > /etc/ssh/sshd_config.d/00-no-passwords.conf
   sshd -t && rc-service sshd restart
   sshd -T | grep -i passwordauthentication

3. Hunt for logins. Look for password logins to accounts that have no password, then review doas use, new users, authorized_keys and unexpected python3 installs (GreyNoise, via Ars Technica).

   grep 'Accepted password for' /var/log/messages

4. If you cannot rule out a login, treat the host as compromised, rebuild it and rotate every secret it held (Alpine advisory).
5. Rebuild images from Alpine 3.21.10, 3.22.8, 3.23.8 or 3.24.4 or later. Earlier images carry the old package.

What should have been in place

• Key-only SSH with PasswordAuthentication no. Alpine notes cloud-init images already write that setting.
• Port 22 reachable only from a VPN or an allowlist, not from the whole internet.
• A post-upgrade check that the running sshd is the patched build, since the package upgrade alone left the old daemon up.
• Authentication logs shipped off the host, with an alert on password logins to service accounts.
• An inventory of which hosts and images are musl-based.

Questions people ask

Digiton's production review lists which hosts and images expose SSH and how each one authenticates, and the checks it runs are on the vibe coded app audit page.

How this brief was made: researched from the sources below, drafted with AI assistance and checked against each source on the dates shown. See the editorial policy.

Sources

1. OpenSSH release notes, version 10.6p2, 5 November 2026, read 9 November 2026. https://www.openssh.org/releasenotes.html
2. Alpine Linux security advisory, openssh-server password authentication bypass, 5 November 2026, read 9 November 2026. https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/
3. NVD record for CVE-2026-123158, 5 November 2026, read 9 November 2026. https://nvd.nist.gov/vuln/detail/CVE-2026-123158
4. CISA Known Exploited Vulnerabilities catalog, read 9 November 2026. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. Ars Technica, report on active exploitation, 9 November 2026, read 9 November 2026. https://arstechnica.com/security/2026/11/vulnerability-that-lets-hackers-ssh-into-linux-devices-is-under-active-exploitation/
6. Help Net Security, exploitation hours after disclosure, 6 November 2026, read 9 November 2026. https://www.helpnetsecurity.com/?p=390599

More briefs

How these briefs are sourced and corrected. All AI and security briefs