CYBUNKR

OpenSSH “sshole”:Alpine Linux servers let attackers in with any long password

Published

CVE-2026-123158 lets attackers log in to OpenSSH on Alpine Linux, with no password, by sending one over 256 characters. Exploit code is public. Update and restart sshd, or turn off password logins.

If you run servers, cloud machines or containers on Alpine Linux with SSH switched on, update OpenSSH and restart it today, or turn off password logins. An attacker who can reach the SSH port can log in without knowing any password. It takes one connection and works every time (Alpine Linux).

OpenSSH 10.6p2, released on 5 November, carries what the project calls “a critical security workaround” for Linux systems that use the musl C library with PAM disabled (OpenSSH). Working exploit code was public the same day (sshhole-lab, sshhole-repro).

Who is affected

  • sshd before OpenSSH 10.6p2 on Linux with musl and no PAM. Alpine Linux is the example given; for some accounts, any password of 256 to 1,024 characters works (CVE record).
  • On Alpine, that means the standard openssh-server package (built without PAM), or openssh-server-pam with UsePAM no, with password logins on, which is the default. Every release Alpine checked is affected: 3.16 to 3.24 and edge (Alpine Linux).
  • The attacker needs an account with no password set (shown as *, normal for key-only users) and at least one other account with a real password. One user with a password exposes every account without one (Alpine Linux).
  • Alpine's root account has no password by default. SSH's default settings stop password logins as root, but not an attacker who gets in as another user who can become root, for example through doas. Alpine's official tiny-cloud images ship an alpine user with passwordless doas, which becomes exploitable once any password is set on the machine (Alpine Linux).
  • Not affected: containers that don't run sshd, servers with password logins turned off, openssh-server-pam with UsePAM yes, and cloud images set up by cloud-init, which turns password logins off (Alpine Linux).
  • The sshhole.com write-up says OpenSSH on other musl-based Linux builds, such as OpenWrt, Buildroot and Yocto, has the same weakness. Those are often found inside routers and other appliances.

What has been seen so far

A snapshot from 6 November:

  • The bug was reported by Özgün Kültekin of Wakefield (OpenSSH). The sshhole.com write-up traces it to a 2016 change in sshd meeting the way musl reports errors (sshhole.com). The CVE record rates it 8.1 out of 10 (CVE record).
  • Two ready-to-run labs that build a vulnerable server and log in to it were published on 5 November and are linked from the CVE record, which records the exploitation status as “proof of concept” (CVE record, sshhole-lab, sshhole-repro). CIRCL's Vulnerability-Lookup logged more exploit code overnight.
  • We have found no report of attacks in the wild, and it is not in CISA's Known Exploited Vulnerabilities catalog. With a one-line exploit, that can change quickly.

What to do

  • Update and restart: run apk upgrade -U -a, then rc-service sshd restart. Upgrading alone does not replace the sshd that is already running. Alpine 3.21.10, 3.22.8, 3.23.8 and 3.24.4 include the fix, and fixed packages are published back to 3.16 (Alpine Linux, Alpine Linux).
  • If you can't update yet, set PasswordAuthentication no and restart sshd. Check that your key login works first, and keep your session open until you have tested a new login (Alpine Linux).
  • Check whether anyone got in: look in /var/log/messages for Accepted password for an account that has no password, such as alpine, root or a key-only user, and review doas use, new users, files and authorised keys. If you can't rule out a login, treat the machine as compromised (Alpine Linux).
  • Appliances with SSH on: ask the vendor whether its firmware is affected, and keep SSH off the internet unless it is needed.
  • Servers looked after by a provider? Ask them which of your machines run Alpine with SSH open, and when they were updated.

How we can help

Not sure which of your systems run Alpine, or whether one has been accessed? Get in touch.

Sources