CVE-2026-123158 (“SSHole”): OpenSSH Authentication Bypass Exploited in Under 9 Hours — Patch Alpine Linux Now

Imagine discovering that the SSH password protecting your most sensitive server can be bypassed — not by a sophisticated zero-day exploit chain, but by simply sending a very long string of characters. That is precisely what CVE-2026-123158, nicknamed “SSHole” by its discoverer, allows an attacker to do on Alpine Linux systems running OpenSSH without PAM. What makes this especially alarming is not just the flaw itself, but the speed of weaponisation: threat actors were exploiting it on live honeypots less than nine hours after public disclosure. If your infrastructure runs Alpine Linux — in containers, edge appliances, or bare-metal servers — read this before the end of your shift.

What Is CVE-2026-123158 (“SSHole”)?

On 5 November 2026, researcher Özgün Kültekin published details of a password-authentication bypass in OpenSSH’s sshd daemon — a flaw they wryly named “SSHole.” The vulnerability was simultaneously patched in OpenSSH 10.6p2 and assigned CVE-2026-123158, with a CVSS v3.1 base score of 8.1 (High) and a vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

At its core, this is an authentication bypass — not an RCE flaw on its own, but one that can deliver an interactive shell as root or any other account with a locked shadow-file entry. In practice, most Linux distributions ship root with a password field of *, meaning attackers who successfully bypass the check land directly at a root prompt.

Coverage from The Hacker News, Help Net Security, and SOCRadar confirms active exploitation from day one.

The Technical Root Cause: When musl libc Becomes a Security Liability

To understand SSHole, you need to understand how OpenSSH validates passwords. When a user logs in, sshd calls the C library’s crypt() function to hash the supplied password and compare it against the stored hash in /etc/shadow. On most enterprise Linux distributions — RHEL, Ubuntu, Debian — this is handled by glibc, which behaves predictably.

Alpine Linux uses musl libc instead, chosen for its compact footprint — a core reason Alpine is the dominant base image for Docker containers. Here, however, musl’s crypt() implementation has a subtle flaw in how it handles hashes shorter than four characters. The shadow-file entries for locked accounts (* or !) are exactly that: single-character sentinels that are supposed to signal “no login allowed.” musl’s comparator, however, produces a matching result when the submitted password falls within a specific length range (approximately 257 to 1,024 bytes), creating what amounts to a universal key for any locked account.

The fix in OpenSSH 10.6p2 is a defensive check: sshd now explicitly rejects any stored hash shorter than four characters before attempting to call crypt() at all, breaking the vulnerable code path entirely regardless of the C library in use.

Factor	Vulnerable Configuration	Not Affected
C Library	musl libc	glibc (Debian, Ubuntu, RHEL, SLES)
PAM	Disabled (Alpine default)	Enabled — PAM intercepts before crypt()
OpenSSH version	Any < 10.6p2	10.6p2 and above
Attack surface	Any account with *, ! in shadow file (including root)	Accounts with valid password hashes, or key-only auth

Who Is Actually at Risk?

The affected surface is larger than it first appears because Alpine Linux is not just an edge-case distribution. It is the most popular base image on Docker Hub, accounting for a significant proportion of container builds across cloud-native stacks. Any container that:

• Runs Alpine Linux (any branch from 3.16 to edge before the November 5 patch)
• Has OpenSSH’s sshd running inside the container for remote access or CI/CD pipelines
• Does not use PAM, and
• Exposes port 22 — directly or via a jump host, bastion, or load balancer

…is potentially reachable. Beyond containers, network appliances, IoT gateways, and embedded Linux devices frequently ship with musl-based environments for their compactness. This is precisely the class of device that often runs with minimal patching cycles and persistent SSH exposure — a dangerous combination.

This flaw also intersects directly with authentication-bypass risk in ways reminiscent of the SonicWall SAML MFA bypass (CVE-2026-19868) covered here last week — a reminder that authentication mechanisms across the stack deserve constant scrutiny, not just at the perimeter.

How Fast Were Attackers? The 9-Hour Exploitation Window

Speed of exploitation is now the primary threat metric, and SSHole sets an uncomfortable benchmark. Threat intelligence firm Previdian reported that its first observed exploitation attempt arrived fewer than nine hours after CVE-2026-123158 was publicly disclosed. Within that window, Previdian’s Alpine Linux honeypot was successfully compromised, with the attacker obtaining root access.

The observed post-exploitation activity was relatively benign — reconnaissance commands id, uname, and hostname sent through non-interactive SSH sessions — consistent with automated scanners fingerprinting newly exploitable hosts for follow-on campaigns. However, once an attacker has root via SSH, the possibilities are unlimited: data exfiltration, ransomware staging, lateral movement, and persistent backdoor installation are all straightforward next steps.

The compressed timeline from disclosure to exploitation highlights a structural risk in how organisations handle patch windows. A 72-hour “patch by next change window” policy is effectively no policy at all when attackers have working exploits in under 10 hours. This matches a broader pattern seen on this site in earlier coverage of Linux kernel TCP exploits, where the patch-to-attack gap continues to shrink.

India’s Exposure: Why NOC and SOC Teams Here Must Act Today

India’s cloud-native adoption has accelerated sharply over the past three years, and Kubernetes-on-EKS, AKS, or GKE deployments almost universally use Alpine-based containers for sidecar proxies, init containers, debugging images, and application microservices. The Mumbai, Hyderabad, and Pune AWS and Azure regions host a substantial share of this workload.

Beyond cloud, many Indian enterprises in BFSI, manufacturing, and government run Alpine-based edge appliances and micro-VMs for branch network management. CERT-In’s advisory cycle typically lags multi-day after international disclosures; waiting for a formal Indian advisory before patching is not an acceptable posture for CVE-2026-123158.

From a zero-trust perspective, this vulnerability is a direct attack on the “verify explicitly” pillar. Zero-trust architectures built around FortiGate and FortiAuthenticator-based campus designs typically enforce multi-factor authentication at the network perimeter, but if containerised workloads behind that perimeter have exposed SSH with this flaw unpatched, the trust boundary is severely eroded.

What You Should Do Right Now: Expert Action Checklist

This is not a “monitor and patch by Friday” situation. Here is the prioritised response playbook:

1. Identify all Alpine Linux instances immediately. Run an asset inventory query across your cloud console (AWS SSM, Azure VM inventory, GKE node pools) and your on-premises CMDB filtering for musl or Alpine. Include container images in your registry — query your image scanner or run docker images --format "{{.Repository}}:{{.Tag}}" and cat /etc/alpine-release inside running containers.
2. Patch to OpenSSH 10.6p2. On Alpine, run apk update && apk upgrade openssh for every affected branch. For container images, rebuild from the patched alpine:3.21 (or later) base and redeploy. Restart sshd after upgrade — it does not automatically reload.
3. Block or restrict SSH access on the firewall perimeter. If SSH to container workloads is not strictly required from outside your internal jump-host network, enforce an ingress deny-all rule for port 22 at the FortiGate or cloud security group now. Zero-trust principles demand that all SSH sessions originate from known, authenticated bastion hosts — not from the open internet.
4. Audit your shadow file for accounts with * or ! in Alpine containers. Run awk -F: '$2 == "*" || $2 == "!" {print $1}' /etc/shadow in each container. Any result means that account was potentially accessible before patching — treat it as a compromised credential and rotate accordingly.
5. Enable PAM if you cannot patch immediately. As a temporary workaround, enabling PAM in /etc/ssh/sshd_config (UsePAM yes) prevents the vulnerable crypt() path from being reached. However, PAM must then be correctly configured — this is a mitigation, not a fix.
6. Hunt for indicators of compromise. Review SSH auth logs (/var/log/auth.log or journalctl -u sshd) for successful logins using accounts that should never log in interactively. Look for id, uname, and hostname commands immediately following an SSH session — the exact TTPs Previdian observed.
7. Update your base images in CI/CD pipelines. Tag your Dockerfile ARGs or FROM lines to pin to a patched Alpine version and trigger a full rebuild-and-deploy cycle in all pipelines today.

Frequently Asked Questions

Does this affect all OpenSSH versions on all Linux distributions?

No. CVE-2026-123158 is specific to OpenSSH sshd running on musl libc without PAM. This means Alpine Linux in its default configuration is affected; Debian, Ubuntu, Red Hat Enterprise Linux, SUSE, and Fedora are not affected because they use glibc and typically have PAM enabled. If your fleet is exclusively RHEL or Ubuntu, you are not exposed by this specific CVE.

Can an attacker exploit this without knowing a valid username?

The attacker needs a valid account name with a * or ! shadow entry. root fits this profile on the overwhelming majority of Alpine installations — it is a locked account by default on many base images. So while a username is technically required, root is effectively a universal first guess, making username enumeration largely unnecessary.

We use SSH key authentication only. Are we still at risk?

Key-only authentication (with PasswordAuthentication no in /etc/ssh/sshd_config) does prevent this specific bypass, as the vulnerable code path is only reached during password authentication. However, if PasswordAuthentication is not explicitly disabled — which is not the default on all Alpine images — you are exposed. Verify the setting explicitly rather than assuming it is in place. Regardless, patching to OpenSSH 10.6p2 eliminates the flaw entirely.

How do I confirm my Alpine systems are patched?

Run ssh -V or sshd -V and confirm the version is OpenSSH_10.6p2 or later. On Alpine, apk info openssh shows the installed package version. If your package manager shows a version less than 10.6p2-r0 (Alpine naming), you are unpatched. Cross-reference with the official OpenSSH release notes for confirmation.

---

CVE-2026-123158 is a stark reminder that the smallest components of your stack — a lightweight container base image, a minimal C library — can carry outsized risk. The nine-hour exploitation window is not an outlier; it is the new normal for high-impact, easy-to-exploit authentication flaws. India’s expanding cloud-native footprint, combined with the ubiquity of Alpine in container ecosystems, makes this a priority action item for every enterprise security team this week.

At P J Networks, we help Indian enterprises audit their containerised environments, harden their zero-trust architectures, and build SOC playbooks that respond at the speed attackers move — not the speed of a Friday change-management window. If your team needs an urgent security review or a gap assessment against CVE-2026-123158 and similar authentication-bypass threats, reach out to Sanjay Seth directly. The conversation is free; a breach is not.