CVE-2026-123158 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-11-05

Added to CISA KEV: 2026-11-09 4 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL — IMMEDIATE PATCH: Upgrade OpenSSH to version 10.6p2 or later on ALL Alpine Linux and musl libc-based systems. For Docker environments, rebuild all Alpine-based images with the patched OpenSSH package.
CRITICAL — INCIDENT RESPONSE: If patching is not immediately possible, audit all SSH access logs for authentication events using passwords of 256+ characters. Any successful login with such a password against an account that should not have had access is a confirmed compromise indicator.
URGENT — WORKAROUND (if patch unavailable): Set 'MaxAuthTries' and restrict maximum password length in sshd_config; alternatively, disable password authentication entirely ('PasswordAuthentication no') and enforce key-based authentication only. Enable PAM if feasible on the platform.
URGENT — NETWORK CONTROLS: Restrict SSH access via firewall rules or security groups to known IP ranges. Remove SSH exposure from public internet where not operationally required.
MONITORING: Deploy alerts for SSH login events originating from unexpected IPs on Alpine/musl-based hosts. Monitor for new user account creation, cron job additions, SSH authorized_keys modifications, and new SUID binaries post-authentication.
CONTAINER HYGIENE: Audit all Docker Compose files, Kubernetes manifests, and container configurations for sshd exposure. Prefer exec-based access (kubectl exec, docker exec) over in-container SSH for containerised workloads.
PATCH PRIORITY: CRITICAL — treat as P0. Active exploitation in the wild, unauthenticated, network-exploitable, full system compromise potential. Patch or mitigate within 24 hours for internet-facing systems.

🔍 Web Intelligence (Kagi · 2026-11-09)

Summary

CVE-2026-123158, also known as "SSHole," is a critical authentication bypass vulnerability affecting `sshd` in OpenSSH versions prior to 10.6p2 ^[6]^[8]. The flaw arises specifically on Linux systems that utilize the `musl` standard C library without Pluggable Authentication Modules (PAM) ^[2]. Because the SSH server can misinterpret certain input strings as valid password hashes, it allows remote, unauthenticated attackers to bypass authentication mechanisms and gain unauthorized access to accounts, including those with no password or specific configurations ^[2]^[5].

Exploitation

Active Exploitation: The vulnerability is being actively exploited in the wild, with reports of hackers successfully gaining root access on honeypots within hours of disclosure ^[1].
Availability: Proof-of-concept information and exploit techniques are publicly available ^[7].
Attack Prerequisites:

- Network access: An attacker must have network connectivity to the targeted SSH port ^[5]. - Authentication: None; this is an unauthenticated bypass ^[2]. - User Interaction: None required. - Environment: The system must be using the `musl` C library and running OpenSSH without PAM ^[2].

Affected Products & Patches

Affected Versions: OpenSSH versions prior to 10.6p2 ^[6].
Patches: Update to OpenSSH 10.6p2 or later ^[1].
Mitigations/Workarounds:

- Disable password authentication in `sshd_config` ^[3]. - Enable PAM on systems utilizing `musl` libc ^[3]. - As a temporary measure, restrict the maximum password length to under 256 characters in `sshd_config` to prevent the conditions that lead to the exploit ^[3].

Impact

Access Capability: Successful exploitation grants an attacker full, unauthorized access to the targeted user account, potentially including root-level access if the target account has such privileges ^[1].
Business Risk: Internet-facing deployments, particularly containerized environments like Alpine Linux that often rely on default `musl`/no-PAM configurations, face an immediate risk of full system compromise, data theft, and persistence establishment by malicious actors ^[1]^[4].

Sources

Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain ...
Attackers are exploiting CVE-2026-123158 in OpenSSH, with root access confirmed on an Alpine Linux honeypot. OpenSSH 10.6p2 fixes the flaw.
CVE-2026-123158
A flaw was found in OpenSSH. When running on Linux systems utilizing the musl standard C library without Pluggable Authentication Modules ... A flaw was found in OpenSSH. When running on Linux systems utilizing the musl standard C library without Pluggable Authentication Modules (PAM), the SSH serve…
CVE-2026-123158 - Vulnerability Details - OpenCVE
Disable password authentication in sshd configuration or enable PAM on systems using musl libc until the patch is applied. Restrict the maximum password length to under 256 characters in sshd_config as a temporary measure to prevent accidental acceptance of valid long strings. Generated by OpenCVE A…
CVE-2026-123158: OpenSSH Authentication Bypass
CVE-2026-123158 lets attackers bypass SSH password authentication on vulnerable musl-based Linux systems such as Alpine Linux.
sshole (CVE-2026-123158): OpenSSH password bypass ...
On an affected system, an attacker who can reach the SSH port can log in to an account that has no password by sending a very long password. The ...

🔴 CVE-2026-123158