Critical OpenSSH flaw lets attackers log into password-disabled accounts on musl-based Linux
- Severity
- Critical
- Highest CVSS
- 8.1
- Exploited
- Not known
- Sources
- 1
What happened
CVE-2026-123158 (SSHole) affects OpenSSH servers on musl-based Linux, notably Alpine, where OpenSSH is built without PAM and password authentication is enabled. Over-long passwords (257 to 1,024 bytes) cause musl's crypt to return '', matching the locked-password marker, so login succeeds for password-disabled accounts such as Alpine's default 'alpine' user, which has passwordless doas. Official Alpine cloud images from 3.18.11 to 3.24.3 are affected. Update to OpenSSH 10.6p2 or the fixed Alpine openssh package; if that is not possible, disable password authentication. Hunt for 'Accepted password' log entries for passwordless accounts and treat any host where login cannot be ruled out as compromised.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Update OpenSSH to version 10.6p2 or install the fixed Alpine openssh package.
- If you cannot update, disable password-based authentication in the OpenSSH configuration and set up key-based authentication.
- Check logs for 'Accepted password' entries on accounts that have no password, such as root, key-only users or the default alpine user.
- Review doas usage and recently created users, and treat any server where a login cannot be ruled out as compromised.
Written by AI from the sources, checked against them