OpenSSH CVE-2026-123158 auth bypass on Alpine Linux exploited

An OpenSSH vulnerability, CVE-2026-123158, lets a remote attacker log in to passwordless accounts on Linux systems that use the musl C library without PAM, such as Alpine Linux. Threat intelligence firm Previdian says it is being exploited, according to Help Net Security. The fix is OpenSSH 10.6p2, released on November 5.

What happened

The flaw, nicknamed sshole, was found by researcher Özgün Kültekin. NVD describes it as a password authentication bypass in sshd: on affected builds, sshd lacks a workaround for a case where a string is misinterpreted as a password hash. For some account configurations, any password between 256 and 1024 characters is accepted.

The Alpine Linux team’s advisory says an attacker who can reach the SSH port can log in without knowing any password, in one connection and without retries.

Is OpenSSH affected? Am I affected?

You are affected if all of the following apply:

• sshd is an OpenSSH version before 10.6p2.
• The system runs Linux with the musl C library.
• Passwords are not checked through PAM.

Alpine Linux is the example platform named by NVD. Reporting says accounts that should never use a password are the ones at risk, including root, key-only deploy users, LDAP users and the default user on Alpine’s AWS and Azure images. NVD lists no affected-product data beyond the description, and the OpenSSH project has published release notes for 10.6p2.

Technical details

NVD scores the flaw CVSS 8.1 (High) with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, and classifies it as CWE-394. Network reachable, no privileges and no user interaction are needed; the high attack complexity reflects the specific build and account conditions.

The researcher traces the cause to how musl’s password hashing function reports failure for very long passwords. The failure value matches the placeholder stored for accounts with no password, and sshd treats it as a successful match.

Is it exploited in the wild?

Previdian founder Ryan Dewhurst told Help Net Security that the first observed attempt arrived less than nine hours after the CVE was published, and that the company confirmed root access on a honeypot running real Alpine Linux and OpenSSH. The source IP was 89.116.89[.]18, which used oversized passwords and ran reconnaissance commands including id, uname and hostname through non-interactive SSH sessions. Previdian has counted eight attempts, all from that one address and all seen by one sensor. Previdian lists the flaw as exploited; CISA has not added it to its catalog at the time of reporting.

Why this matters

This section is our analysis, not new reporting. Exploitation needs only network access to port 22 and a long string, so any internet-facing Alpine host with sshd before 10.6p2 is a realistic target, and containers or cloud images built on Alpine are easy to overlook. Because the observed activity was reconnaissance by a single address, treat it as early scanning rather than proof of wider compromise, but the low effort required means more actors can be expected to try it. Patch internet-facing hosts within hours rather than waiting for a maintenance window.

What to do

1. Inventory hosts and images running Alpine or other musl-based Linux with OpenSSH.
2. Upgrade OpenSSH to 10.6p2 or the patched package your distribution provides, and rebuild container images that bundle sshd.
3. Until patched, restrict SSH to trusted networks or a VPN, and avoid exposing port 22 to the internet.
4. Review authentication logs for successful logins, especially for root or key-only accounts, that follow unusually long password attempts.
5. Hunt for short bursts of id, uname and hostname run over non-interactive SSH sessions, and check the indicator below.

Indicators and detection

Source IP: 89.116.89[.]18 (Japan-based, per Previdian)
Commands observed: id, uname, hostname

Failed or successful logins with passwords between 256 and 1024 characters are a useful detection signal for this specific flaw.

Related free tool: test how long a password would take to crack with our Password Strength Checker. It runs entirely in your browser and nothing you type is sent or stored.

Related coverage

• Linux kernel CVE-2026-46300 added to CISA KEV, exploited
• Palo Alto PAN-OS GlobalProtect flaw exploited by ransomware (CVE-2026-0257)
• AI-generated payloads hit government Linux systems in CL-UNK-1211 campaign

Sources

• Help Net Security: OpenSSH flaw exploited in the wild just hours after disclosure
• NVD: CVE-2026-123158
• Alpine Linux: OpenSSH password authentication bypass
• OpenSSH 10.6p2 release notes