Skip to content
securitytabs

LiveUpdated

OpenSSH 'sshole' login bypass on Alpine and other musl Linux systems is exploited

A flaw in the OpenSSH remote-login service lets attackers sign in without a password to some Linux systems, including Alpine Linux, and attackers are already using it. Organizations running affected systems should update now.

What's new

Newest coverage

TimelineWhat should my organization do?

Vulnerabilities

What happened

OpenSSH released version 10.6p2 on November 5 to fix CVE-2026-123158, nicknamed sshole. The Hacker News reports that it affects Linux systems running OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled. Horizon3.ai says this includes Alpine Linux in its default configuration. [1][2][3]

Help Net Security quotes the Alpine Linux team as saying an attacker who can reach the SSH port can log in to accounts that have no password set, in one connection and without retries. NVD rates the flaw 8.1. [1][3]

Exploitation

Threat intelligence firm Previdian warned that attackers began exploiting the flaw within hours of disclosure, and The Hacker News reports they gained root access on a honeypot. The SANS Internet Storm Center says its honeypots saw an increase in exploitation attempts. BleepingComputer reports attackers are running commands, stealing credentials and setting up persistent access. [1][2][4][5]

CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalogue, its list of flaws attackers are using, on November 9, with a federal due date of November 12. Known ransomware use is listed as unknown. [6]

Patches

OpenSSH versions before 10.6p2 are affected, according to Canada's advisory listing. [7]

Timeline

  1. CISA added the flaw to its Known Exploited Vulnerabilities catalogue. [6]

  2. The SANS Internet Storm Center reported rising exploitation attempts against its honeypots. [4]

  3. Previdian warned that attackers were exploiting the flaw within hours of disclosure. [1][2]

  4. OpenSSH released version 10.6p2 fixing the flaw. [1]

Explained

The technology and terms in this story. Learn more

Why it was possible

The weaknesses behind this story's CVEs, from each CVE Record.

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Systems using Alpine Linux or other musl-based Linux with OpenSSH may let attackers in without a password, and exploitation is under way. [1][3]

What to do

  1. Ask your hosting provider or IT provider whether any servers run Alpine Linux. [3]
  2. Ask them to confirm those servers have been updated to OpenSSH 10.6p2. [1]

Mid-size company

A small IT or security team

What to know

CISA set a federal due date of November 12, and exploitation has been seen against honeypots. [6][4]

What to do

  1. Inventory hosts and containers running OpenSSH on musl-based systems such as Alpine Linux with PAM disabled. [2][3]
  2. Upgrade OpenSSH to 10.6p2 or later. [1][7]

Large enterprise

A security operations team

What to know

Attackers are reported to run commands, steal credentials and set up persistence after login, so unpatched hosts may need compromise review. [5]

What to do

  1. Patch affected hosts to OpenSSH 10.6p2 and find exposed SSH services on musl-based images. [1][3]
  2. Hunt for unexpected SSH logins to accounts without passwords on unpatched hosts. [5][4]

Sources

  1. [1]Help Net Security · Nov 6, 12:49 UTC
    OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158)context
  2. [2]The Hacker News · Nov 6, 15:21 UTC
    Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypotcontext
  3. [3]Horizon3.ai · Nov 6, 23:29 UTC
    CVE-2026-123158 | OpenSSH musl Password Authentication Bypass & Remote Code Execution Vulnerability (*sshole)context
  4. [4]US-CERT / SANS Internet Storm Center · Nov 8, 15:44 UTC
    Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th)context
  5. [5]BleepingComputer · Nov 9, 16:04 UTC
    Hackers exploit SSHole OpenSSH flaw to breach Linux systemscontext
  6. [6]CISA Advisories · Nov 9, 12:00 UTC
    CISA Adds Four Known Exploited Vulnerabilities to Catalogcontext
  7. [7]Canadian Centre for Cyber Security · Nov 9, 18:34 UTC
    OpenBSD security advisory (AV26-1130) - Update 1context