The OpenSSH sshole vulnerability (CVE-2026-123158) is already helping attackers break into Linux machines. The scary part? On affected systems, an attacker can log in as root by typing a very long password. Any very long password. However, the good news is that it hits only a specific type of Linux system, and the fix is simple.
If you use Docker, Alpine Linux, home routers or small IoT boards, this one is worth five minutes of your time. So, let’s break it down in simple words.
What is the OpenSSH sshole vulnerability?
OpenSSH is the program that lets you log in to a remote Linux machine using the ssh command. In fact, almost every cloud server, router and container host uses it.
The new flaw, tracked as CVE-2026-123158, is an authentication bypass. In other words, on affected systems, accounts that are supposed to have no password at all (like root on Alpine, or users who log in only with SSH keys) will accept any password that is longer than 256 characters.
Researcher Özgün Kültekin found the bug and gave it the “sshole” nickname. Then, OpenSSH fixed it in version 10.6p2 on 5 November 2026.
Key facts at a glance
- CVE ID: CVE-2026-123158 (nickname: “sshole”)
- Type: Password authentication bypass in OpenSSH
- Severity: High, CVSS 8.1 (as listed by SecurityOnline)
- Affected: OpenSSH before 10.6p2 on Linux systems that use the musl C library and do not use PAM
- Examples: Alpine Linux (default openssh-server), OpenWrt, Buildroot, Yocto
- Fixed in: OpenSSH 10.6p2 (released 5 November 2026); Alpine patched branches 3.16 to edge the same day
- Exploited? Yes. Attacks were seen within hours of the CVE going public
- CISA KEV: Reportedly added on 9 November 2026, with a 12 November deadline for US federal agencies
How does the OpenSSH sshole vulnerability work? (Simple explanation)
To understand this, you need to know two small things.
1. How Linux stores passwords. Linux does not save your real password. Instead, it saves a hash, which is like a fingerprint of the password. Then, when you log in, the system hashes what you typed and compares the two fingerprints. Finally, if they match, you are in.
2. What musl is. Every Linux program needs a “C library” for basic jobs. For example, Ubuntu and Debian use one called glibc. However, Alpine and many small embedded systems use a lighter one called musl.
Now, here is the bug, step by step:
- Some accounts have no real password. On Alpine, the root account stores just a
*instead of a hash. This normally means “password login is not allowed”. - When someone types a password that is longer than 256 bytes, musl’s password-hashing function fails. Instead of returning “error”, it returns the string
*. - sshd then compares this
*with the stored*. They match. So sshd thinks the password is correct. - Result: the attacker logs in, even as root. Reports say any password between 257 and 1,024 characters works.
Think of it like a locked door with no keyhole. The lock is supposed to say “no key fits”. But if you push a very long stick into it, the lock gets confused and simply opens. Therefore, the OpenSSH sshole vulnerability is so easy to exploit once an attacker finds an exposed SSH port.
Who is affected by the OpenSSH sshole vulnerability?
Likely affected (if running OpenSSH older than 10.6p2 with password login turned on):
- Alpine Linux servers and VMs using the default openssh-server package
- Alpine “tiny-cloud” cloud images (SOCRadar reportedly lists versions 3.18.11 to 3.24.3)
- OpenWrt routers, and Buildroot or Yocto-based IoT and embedded devices
- musl-based Docker images that run sshd inside the container. The researcher says these are worth checking, though not every image runs sshd
Not affected:
- glibc-based systems such as Ubuntu, Debian and Fedora
- Systems that check passwords through PAM
- Dropbear SSH (a different SSH server) and OpenBSD
Is the OpenSSH sshole vulnerability being exploited right now?
Yes. According to Help Net Security, exploitation started less than nine hours after the CVE was published. In addition, security firm Previdian reportedly confirmed root access on one of its honeypot servers.
SecurityWeek reported that Previdian saw 20 attempts from 13 IP addresses in 9 countries between 6 and 8 November. Meanwhile, watchTowr said that, so far, mostly botnets and crypto miners are using it. Also, experts expect more attackers to join soon.
One more warning: some “proof-of-concept” exploit code is circulating on GitHub. However, Help Net Security notes these are unverified and may themselves contain malware. So, do not download and run them out of curiosity.
Quick check: is your server exposed to the OpenSSH sshole vulnerability?
Answer two questions to see your risk level.
How to fix the OpenSSH sshole vulnerability
If you manage any Alpine, OpenWrt or musl-based system with SSH, follow these steps. Also, patching the OpenSSH sshole vulnerability takes only a few minutes.
Step 1: Check if your OpenSSH version has the sshole vulnerability
ssh -V
# If the version is lower than OpenSSH_10.6p2, you need to updateStep 2: Update and restart sshd (Alpine)
Updating the package alone is not enough. This is because the running sshd keeps using the old code until you restart it.
apk update
apk upgrade openssh
rc-service sshd restartHowever, on OpenWrt, Buildroot or Yocto devices, install the firmware or image update from your vendor or rebuild with OpenSSH 10.6p2.
Step 3: Turn off password login (quick mitigation)
If you cannot update today, disable password login and use SSH keys only. Open /etc/ssh/sshd_config and set:
PasswordAuthentication noThen restart sshd. You can confirm the setting with:
sshd -T | grep -i passwordauthenticationStep 4: Look for signs of an OpenSSH sshole vulnerability attack
grep "Accepted password for" /var/log/messagesLook for successful password logins to accounts that should never use a password, like root. Also review doas usage, newly created users and authorized_keys files. However, if you cannot rule out a compromise, treat the machine as hacked and rebuild it.
Related reading: another recent Linux supply-chain risk is covered in our guide to the APT flaw CVE-2026-109518, and you can compare it with the PHP2Shell vulnerability. In short, whatever you run, patch the OpenSSH sshole vulnerability first, because attackers are already scanning for it.
Key takeaways
- “sshole” (CVE-2026-123158) lets attackers log in with any password longer than 256 characters on affected systems.
- It affects OpenSSH before 10.6p2 on musl-based Linux without PAM, mainly Alpine, OpenWrt, Buildroot and Yocto.
- Ubuntu, Debian, Fedora and other glibc systems are not affected.
- Attacks began within hours. Update to OpenSSH 10.6p2 and restart sshd.
- Best long-term habit: use SSH keys and disable password login on servers.
FAQ on the OpenSSH sshole vulnerability
I use Ubuntu on my laptop. Am I at risk?
No. This is because Ubuntu uses glibc and PAM, so this specific bug does not affect it. Still, keep your system updated.
Are all Alpine Docker containers vulnerable?
Not automatically. This is because most containers do not run an SSH server at all. However, risk exists only if the container runs sshd with password login enabled and an older OpenSSH.
Why does a long password break security?
Because musl’s hashing function returns * on failure, and that happens to match the * stored for accounts with no password. In other words, it is a logic mistake, not a weak password problem.
Is updating the package enough?
No. Instead, you must also restart the sshd service, or the old vulnerable code keeps running.
What is the CISA KEV catalog?
It is a list kept by the US Cybersecurity and Infrastructure Security Agency of vulnerabilities confirmed to be exploited in real attacks. As a result, US federal agencies must fix them by a set deadline.
GK Practice Questions on the OpenSSH sshole Vulnerability
Test your understanding with these practice questions.
Section A: Multiple Choice Questions (MCQs)
1. What is the CVE ID of the OpenSSH “sshole” flaw?
a) CVE-2026-19868 b) CVE-2026-123158 c) CVE-2026-119977 d) CVE-2024-6387
Show answer
Answer: b) CVE-2026-123158
2. Which OpenSSH version fixes the sshole flaw?
a) 9.8p1 b) 10.0 c) 10.6p2 d) 11.0
Show answer
Answer: c) 10.6p2
3. The flaw affects Linux systems using which C library?
a) glibc b) musl c) uClibc d) bionic
Show answer
Answer: b) musl
4. Which of these systems is NOT affected by sshole?
a) Alpine Linux b) OpenWrt c) Ubuntu d) Buildroot
Show answer
Answer: c) Ubuntu
5. Passwords longer than how many bytes trigger the bug?
a) 64 b) 128 c) 256 d) 2,048
Show answer
Answer: c) 256
6. KEV, a catalog of actively exploited bugs, is maintained by which agency?
a) CERT-In b) NIST c) CISA d) ENISA
Show answer
Answer: c) CISA
Section B: Short Answer Questions
7. What type of vulnerability is sshole?
Show answer
Answer: A password authentication bypass in OpenSSH.
8. Who discovered the sshole flaw?
Show answer
Answer: Researcher Özgün Kültekin.
9. On which date was OpenSSH 10.6p2 released with the fix?
Show answer
Answer: 5 November 2026.
10. Name one quick mitigation if you cannot patch immediately.
Show answer
Answer: Set PasswordAuthentication to “no” (use SSH keys only) or disable SSH.
11. What must you do after installing the OpenSSH update?
Show answer
Answer: Restart the sshd service.
Section C: Descriptive / Mains Questions
12. Explain how the sshole vulnerability lets an attacker log in without knowing the password. Why are glibc-based systems safe?
Show answer
Explain password hashing, the “*” stored for no-password accounts, musl’s crypt() returning “*” for inputs over 256 bytes, and the resulting false match. Note that glibc systems and PAM-based authentication handle this differently, so they are not affected.
13. “Patch speed now decides security.” Discuss with reference to the sshole flaw being exploited within hours of disclosure.
Show answer
Cover the short gap between CVE publication and attacks, botnets and crypto miners scanning the internet, the role of the CISA KEV catalog, the need to restart services after patching, key-based authentication as defence in depth, and risks to IoT and routers that are rarely updated.
