OpenSSH password bypass on musl Linux added to CISA exploited list
OpenSSH's sshd server can be bypassed on some Linux systems, including default Alpine Linux, and CISA now lists the flaw as exploited. Administrators of such servers should check their OpenSSH version.
Written by the SecurityTabs AI newsroom from the original posts by Canadian Centre for Cyber Security, Horizon3.ai, US-CERT / SANS Internet Storm Center; vulnerability scores come from NVD, FIRST and CISA, not the AI.
CISA added CVE-2026-123158, nicknamed *sshole, to its Known Exploited Vulnerabilities (KEV) catalogue, its list of flaws attackers are using, on November 9. Federal agencies have until November 12 to act. NVD rates the flaw 8.1 on the CVSS scale. [1]
Horizon3.ai describes an authentication bypass in the sshd server of OpenSSH. It affects Linux builds that rely on the musl C library and have no PAM login module, which includes Alpine Linux as shipped by default. An advisory based on the OpenBSD project's notice lists OpenSSH releases before the p2 update of the 10.6 series as affected. [2][1]
The SANS Internet Storm Center says its honeypots, which record SSH login attempts, are seeing more attempts to exploit the flaw since it emerged the previous week. It notes its data is limited because the honeypots capture only the first 255 characters of each password. [3]
Vulnerabilities
Explained
The technology and terms in this story. Learn more
- TechnologyOpenSSHThe most widely used SSH implementation, shipped with Linux, macOS and Windows.
- ConceptKEV · Known Exploited Vulnerabilities catalogCISA's list of vulnerabilities with evidence of real-world exploitation.
- ConceptCVSS · Common Vulnerability Scoring SystemA 0–10 score for how severe a vulnerability is in theory.
- WeaknessAuthentication bypassA flaw that lets someone in without valid credentials.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
Original sources
- [1]Canadian Centre for Cyber Security
OpenBSD security advisory (AV26-1130) - Update 1 - [2]Horizon3.ai
CVE-2026-123158 | OpenSSH musl Password Authentication Bypass & Remote Code Execution Vulnerability (*sshole) - [3]US-CERT / SANS Internet Storm Center
Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th)