Public PoC for OpenSSH sshole Bypass; Update to 10.6p2
CVE-2026-123158, dubbed sshole, allows login as root and into SSH key-only accounts on musl libc Linux systems without PAM, such as Alpine, OpenWrt, Buildroot and Yocto, using any password from 257 to 1,024 bytes. The fix ships in OpenSSH 10.6p2 and in patched Alpine packages; users are urged to apply it and restart sshd. A public proof of concept from Positive Technologies exists, with no exploitation reports so far, and researchers expect mass scanning within hours.
What happened
A flaw in OpenSSH, CVE-2026-123158, lets attackers log in via SSH to passwordless accounts, including root, on musl libc Linux servers without PAM, such as Alpine. It only takes network access, an account name, and a password between 257 and 1,024 bytes. OpenSSH rates the flaw critical; SecurityWeek assigns a CVSS score of 8.1.
Why it matters
On affected servers, the attacker gains access with the privileges of the targeted account, potentially reaching root. The attack takes a single connection and works every time, according to Alpine Linux. The default alpine user in official tiny-cloud images for AWS and Azure is affected, and researchers expect automated mass scanning within hours.
What to do
Update openssh-server to OpenSSH 10.6p2 or to Alpine's patched packages and restart sshd. If updating is not possible now, disable password authentication and restart sshd. Inventory every server running musl libc without PAM, including Alpine, OpenWrt, Buildroot and Yocto.
For the technical team
- CVE
- CVE-2026-123158
- Affected
- OpenSSH Portable (Linux com musl libc, sem PAM) · OpenSSH Portable on Linux distributions using musl libc without PAM: Alpine, OpenWrt, Buildroot, Yocto and others. Includes Alpine's standard openssh-server package. On Alpine, every release checked, 3.21 through 3.24 and edge, plus older releases 3.16 to 3.20 that no longer receive regular updates. Since version 3.16, Alpine uses '*' to secure the root account.
- Exploitation
- Public proof of concept released by Positive Technologies (PT-2026-137533); researcher @0xacb published a reproduction of the bug. Fredrik Almroth of Detectify says there are no exploitation reports yet but expects scanning within hours; Jake Knott of WatchTowr expects attempts by the weekend.
- Fix
- OpenSSH 10.6p2. Alpine has published fixed packages and urges users to apply the patch and restart sshd to replace the running daemon. Without updating, mitigation: disable password authentication and restart sshd.
- Vector
- sshd on Linux with musl libc and password verification without PAM. musl crypt returns '*' for passwords over 256 bytes, the same value as the shadow field of locked accounts, and sshd accepts the login. Conditions: password authentication enabled, an account with the '*' field (root, an SSH key-only account, the alpine user in tiny-cloud images, or an account from a directory service via musl-nscd) and at least one local account with a $5$ or $6$ hash. The attacker needs network access to the SSH port and the account name.
- More details
- Flaw found by Özgün Kültekin of Wakefield. According to OpenSSH developer Damien Miller, the defect sits outside sshd but is exploitable via sshd; he cited rapid bug rediscovery by AI agents as the reason for the fast release. According to Fredrik Almroth, Shodan lists around 22 million systems with SSH open on port 22. Each attempt is a single connection, works every time and needs no retries, according to Alpine.
Timeline
Research details that on Linux systems using musl libc without PAM, some accounts accept any password between 257 and 1024 characters.
Positive Technologies discloses a public proof of concept (PT-2026-137533) for the authentication bypass, already fixed in OpenSSH 10.6p2.
New details: the flaw also affects Alpine's standard openssh-server package, allows login to SSH key-only accounts using a 257-to-1,024-byte password, and is rated critical by OpenSSH; Alpine has shipped fixed packages.
Want the next updates in your inbox? Get the daily edition →
See all 9 updates
Advisory reaffirms the OpenSSH 10.6p2 fix and recommends restarting sshd; without upgrading, disabling password authentication mitigates the flaw.
Alpine's AWS and Azure images ship the default alpine user affected by the flaw, with passwordless doas granting root; a public reproduction is circulating.
The flaw, dubbed 'sshole', accepts any password over 256 characters on Alpine, OpenWrt, Buildroot and Yocto installations configured without PAM.
Researcher publishes a reproduction of the bug (CVE-2026-123158) and points to a fix in OpenSSH 10.6p2, with the current Alpine package already patched.
Post details the bypass requirements: SSH password logins enabled, password checks without PAM, one account with no password and another with a compatible hash; key-only accounts can also be exposed.
First public disclosure of the flaw, with no fix announced and no exploitation reported yet.
Sources 10 sources
- @ptdbugs @ptdbugs
- @TheHackersNews @TheHackersNews
- @caseyjohnellis @caseyjohnellis
- @0xacb @0xacb
- @0xacb @0xacb
See all 15 sources
- @DarkWebInformer @DarkWebInformer
- @bountywriteups @bountywriteups
- @bountywriteups @bountywriteups
- @DarkWebInformer @DarkWebInformer
- @EnclaveAI @EnclaveAI
- @ethiack @ethiack
- @ethiack @ethiack
- OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux The Hacker News
- @ptdbugs @ptdbugs
- OpenSSH Rushes Patches for ‘SSHole' Authentication Bypass SecurityWeek
