sshole (CVE-2026-123158): OpenSSH password bypass on alpine Linux

On November 5, 2026 OpenSSH released 10.6p2 and Alpine Linux published fixed openssh packages for a password authentication bypass in sshd, CVE-2026-123158. On an affected system, an attacker who can reach the SSH port can log in to an account that has no password by sending a very long password. The bug affects OpenSSH built against the musl C library without PAM, which is the default openssh-server package on Alpine.

The fix came out within a day of the report. OpenSSH’s maintainerssaid they now skip long embargoes because AI tools rediscover reported bugs, sometimes within hours. The10.6p2 release notes commit to shipping fixes as soon as they are ready. Plan to patch OpenSSH within hours of a release.

Who is exposed

A system is exposed when all of these are true:

• sshd runs without PAM. This is the default openssh-server package on Alpine, or openssh-server-pam with UsePAM no.
• Password logins are on, which is the default.
• An account has no password, such as a key-only user or the alpine user on Alpine’s official cloud images 3.18.11 to 3.24.3. That user can run doas as root.
• At least one other account has a password stored as a or hash.

root stays protected by the default PermitRootLogin prohibit-password. Systems built on glibc, such as Debian, Ubuntu and Fedora, are not affected. Neither are systems that log in through PAM. Alpine backported the fix to every branch from 3.16 to edge. MITRE rates the CVE 8.1 (High) on CVSS 3.1.

What we found in public images

We checked public Docker Hub images that run an SSH server and tested the candidates in a local lab. Several widely used ones turn password logins off, including Gitea, Gogs, the Jenkins SSH agent and linuxserver openssh-server unless PASSWORD_ACCESS=true is set. A small number were exposed under their documented setup. Images on Alpine releases before 3.16 need the most attention: they were exploitable in our lab and get no fixed package.

How Cycode helps

The Context Intelligence Graph records the Alpine packages and versions in each scanned container image, so you can see which images include openssh-server and which version they carry. You can also find Dockerfiles that install an SSH server on Alpine, set a password with chpasswd and keep password logins on.

What to do

1. Check each Alpine host and running container that runs sshd. As root, run sshd -T | grep -i -E ‘passwordauthentication|usepam’. The system is not exposed if password logins are off or PAM is on.
2. Update to the fixed version below and restart sshd: apk upgrade -U -a, then rc-service sshd restart. Rebuild and redeploy images whose openssh package is older.
3. If you cannot update, set PasswordAuthentication no, restart sshd and run the check in step 1 again. Make sure key logins work first. On Alpine before 3.16 this is the only fix.
4. Search /var/log/messages for Accepted password for an account that has no password. If you find one, treat the system as compromised.

Fixed versions

Özgün Kültekin of Wakefield reported the issue.

Sources

• Alpine Linux: OpenSSH password authentication bypass
• OpenSSH 10.6p2 release notes
• Damien Miller on the 10.6p2 release
• NVD: CVE-2026-123158
• Researcher write-up