SSHole: attackers exploit an OpenSSH login bypass on Alpine Linux and other musl-based systems
November 7, 2026 (Fixed November 5, attacks from November 6 to 7, listed as exploited November 9, 2026)
OpenSSH released version 10.6p2 on November 5 to close a password login bypass in its server, sshd, nicknamed SSHole (CVE-2026-123158, severity 8.1). It affects Linux systems built with the musl C library and with PAM turned off. Alpine Linux, including its default package, is the main example. Debian and Ubuntu, which use glibc with PAM, are not in the affected configuration, and RHEL is listed as not affected. On an affected system, an account whose password field holds an invalid hash such as "*" can be logged into by sending a very long password, because of how musl's password function handles it. Attempts started on November 6, and GreyNoise saw its first attack on November 7. The Hacker News reports that after getting in, attackers looked around, queried cloud metadata services, tried to read password hashes and root SSH keys, and added their own keys for persistence. One actor installed a Python remote-control agent, and watchTowr reports botnet and cryptominer activity. CISA added the flaw to its exploited-vulnerabilities list on November 9. Fixed packages are out for Alpine and in Debian unstable. The researcher who reported it is Özgün Kültekin of Wakefield.
Why it matters
Alpine Linux is common in containers, appliances and small network devices, and many of them run SSH reachable from the internet. Exploitation started within a day or two of the fix.
What defenders can take from it
- Update OpenSSH to 10.6p2 or your distribution's fixed package on any musl-based system, such as Alpine, and restart sshd.
- If you cannot update right away, set PasswordAuthentication no in sshd_config and use keys only.
- On systems that were exposed, check authorized_keys files and SSH logs for logins you do not recognize, and rotate keys and cloud credentials stored on them.