“SSHole” OpenSSH Flaw Gains Root on Alpine Linux Honeypot Hours After Disclosure (CVE-2026-123158)

Scope: Linux systems running OpenSSH on the musl C library with PAM disabled, including Alpine Linux’s default OpenSSH configuration

Severity: Red

CVE-2026-123158, codenamed SSHole, affects Linux systems running OpenSSH on musl with Pluggable Authentication Modules disabled, a configuration that includes Alpine Linux’s default setup out of the box. The flaw traces back to a 2016 patch originally meant to fix a username enumeration issue, CVE-2016-6210, and allows an attacker to authenticate to certain password-disabled accounts by supplying an arbitrary password between 257 and 1,024 bytes long, which causes the password hash comparison to fail in a way that effectively grants access rather than denying it. Within hours of disclosure, exploitation attempts were confirmed against a honeypot, with root access achieved. As of November 8, exploitation attempts had grown to 20, originating from 13 unique IP addresses spread across Denmark, Iran, Japan, the Netherlands, Norway, Singapore, Sweden, Switzerland, and the United States, indicating broad, distributed interest rather than a single actor. The flaw does not affect Dropbear, glibc-based Linux distributions, non-Linux systems, or any system that authenticates through PAM, which narrows the exposed population but does not make it small, since Alpine is widely used in containerised and minimal server deployments. Organisations running OpenSSH on musl-based Linux, particularly Alpine Linux, must update to OpenSSH 10.6p2 today, and should review /var/log/messages for lines showing an accepted password login on an account that should have no password set, such as alpine, root, or any key-only account, alongside a review of doas usage, recently created user accounts, and recently added authorised keys.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.