OpenSSH Vulnerability: Emergency Fix for SSHole Authentication Bypass

What Happened

A critical OpenSSH vulnerability, tracked as CVE-2026-123158 and dubbed SSHole, or *sshole, lets attackers log in to certain Alpine Linux and other musl-based Linux accounts that are configured to block password authentication. Entering an oversized password is enough. OpenSSH rates the flaw critical and released version 10.6p2 to block it. Alpine has published fixed packages.

The vulnerability is significant because affected accounts are supposed to be unreachable by password, including SSH key-only accounts. On vulnerable systems, an attacker with network access to the server and a valid account name can enter a password between 257 and 1,024 characters and get in. Threat actors are already attempting to exploit the flaw, according to Previdian, as reported by Hacker News.

Timeline

• Nov 5, 2026OpenSSH released version 10.6p2 to block the flaw, and Alpine published fixed packages.
• Nov 5, 2026BleepingComputer reported that the flaw lets attackers log into password-disabled Linux accounts.
• Nov 6, 2026SecurityWeek reported that OpenSSH rushed patches for the SSHole authentication bypass.
• Nov 6, 2026Hacker News reported that threat actors are attempting to exploit the flaw, and that they gained root on a honeypot, according to Previdian.

Who Is Affected

Based on the reporting, these systems and accounts are affected:

The fixed version is 10.6p2.

• Certain Alpine Linux and other musl-based Linux accounts configured to block password authentication.
• Linux systems running OpenSSH on the musl C library with PAM disabled.
• Some Alpine Linux servers running the standard openssh-server package.

Technical Details: OpenSSH Vulnerability

CVE-2026-123158 is an authentication bypass in OpenSSH with a CVSS score of 8.1. It affects Linux systems running OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled. On those systems, some accounts accept any password between 257 and 1,024 characters. That includes accounts with no password set, such as SSH key-only accounts.

The attack vector is network access to the server, a valid account name, and an oversized password between 257 and 1,024 bytes long. The product is OpenSSH, and the fixed version released to block the flaw is 10.6p2.

What to Do This Week

Do this now:

1. Update to OpenSSH version 10.6p2 and apply the fixed packages Alpine has published.
2. Identify every Linux system you manage that uses the musl C library, with particular attention to Alpine Linux servers.
3. Check whether OpenSSH is running with PAM disabled on those systems and whether any accounts are configured to block password authentication.
4. As a general hardening practice, review SSH configurations to confirm that password authentication is disabled wherever key-based authentication is intended.
5. Monitor SSH authentication logs for failed login attempts with unusually long passwords.

What to Tell Clients

Some Linux servers, particularly Alpine Linux servers, need an urgent OpenSSH update. A newly disclosed flaw lets an attacker log in to accounts that should not accept a password at all, simply by entering a very long password.

Your team should update OpenSSH to version 10.6p2 and apply the fixed packages Alpine has published. Until that is done, affected servers should not be reachable over SSH from untrusted networks.

We are checking which of your systems run OpenSSH on musl with PAM disabled. If any are affected, we will patch them or temporarily restrict access.

Frequently Asked Questions

Sources

• OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine LinuxHackernews · Reported
• OpenSSH flaw lets attackers log into password-disabled Linux accountsBleepingcomputer · Reported
• OpenSSH Rushes Patches for ‘SSHole’ Authentication BypassSecurityweek · Reported
• Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on HoneypotHackernews · Reported