In brief

• OpenSSH 10.6p2 was released with a workaround for a critical authentication bypass in some Alpine Linux configurations.
• The flaw, rated 8.1 on CVSS, lets an attacker log in over SSH to accounts without a password under specific conditions.
• Administrators should update, restart sshd, or disable password authentication to close the gap.

Flaw affects Alpine Linux systems without PAM

The vulnerability, nicknamed sshole and tracked as CVE-2026-123158, has been rated 8.1 on the CVSS scale ([OpenSSHに認証バイパス脆弱性「sshole（CVE-2026-123158）」 Alpine Linuxでパスワード不要のSSHログイン、root権限奪取のおそれ – rocket-boys.co.jp](https://rocket-boys.co.jp/security-measures-lab/openssh-sshhole-cve-2026-123158-alpine-authentication-bypass/)). It sits in the interaction between OpenSSH and musl, the lightweight C library used by Alpine Linux and largely absent from other mainstream distributions (Meet *sshole, the vulnerability that lets hackers SSH into Linux devices – Ars Technica). It only applies when OpenSSH is built against musl and runs without PAM, the pluggable authentication framework that handles login and account checks (Alpine Linux Security advisory: OpenSSH-server password authentication bypass – Hacker News).

Conditions for exploitation

Exploitation requires network access to the SSH port and knowledge of an account name whose password field in the shadow file holds an asterisk, a marker for accounts without a password that is typical for key-only logins. The machine must also have at least one other account protected by a SHA-256 or SHA-512 password hash. According to reports, a single connection is enough and no retries are needed. Sending a password between 257 and 1024 bytes triggers the flaw, and one account with a password is enough to make every passwordless account reachable.

Fixes and mitigations

The OpenSSH project published version 10.6p2 on 5 November 2026 with a workaround for the problem (OpenSSH 10.6p2 Critical workaround for alpine without PAM – Hacker News). The Alpine team warns that updating the openssh package does not by itself replace the running daemon, so the sshd service has to be restarted after the update. Administrators who cannot update right away can set PasswordAuthentication to no in the sshd configuration and restart the service, which also closes the gap.

Wider context

The OpenSSH team said it has received a growing number of security reports, many produced by or with the help of AI models. It also said it will make more frequent releases for now, instead of batching fixes until the next scheduled version, so fixes reach users sooner. The vulnerability is reported to be about a decade old. Systems on other platforms could also be exposed if they run the same musl and no-PAM setup.