OpenSSH Password Authentication Bypass Affects Alpine Linux Systems (CVE-2026-123158)

A newly disclosed security vulnerability in OpenSSH could allow attackers to bypass SSH password authentication and gain unauthorised access to Linux systems. The vulnerability, tracked as CVE-2026-123158 and nicknamed “sshole”, affects certain Linux installations using the musl C library without PAM authentication.

The vulnerability was published on 5 November 2026 and has been assigned a CVSS 3.1 score of 8.1, making it a high-severity security issue.

The flaw affects OpenSSH versions before 10.6p2 running on Linux systems where musl libc is used without Pluggable Authentication Modules (PAM). Alpine Linux is one example of a distribution potentially affected by the issue.

How the vulnerability works

CVE-2026-123158 is caused by an authentication-handling problem involving the way OpenSSH interacts with the musl C library’s password-hashing function.

When password verification fails under certain circumstances, musl libc can return an unexpected value. OpenSSH does not correctly handle this response in vulnerable configurations, potentially allowing an attacker to bypass the normal password verification process.

An attacker able to reach an affected SSH service can exploit the problem by submitting an unusually long password, between 256 and 1,024 characters.

For certain account configurations, including accounts with password fields set to an asterisk to indicate that no password is configured, the authentication attempt can succeed despite the attacker not knowing the legitimate password.

This could provide unauthorised access to accounts that would otherwise be inaccessible through normal password authentication.

Systems affected

The vulnerability is particularly relevant to Alpine Linux installations running an SSH server.

According to Alpine Linux, affected releases include:

• Alpine Linux 3.16 to 3.20.
• Alpine Linux 3.21.
• Alpine Linux 3.22.
• Alpine Linux 3.23.
• Alpine Linux 3.24.
• Alpine Linux Edge.

However, not every installation is vulnerable. Exploitation requires specific authentication configurations, including password authentication being enabled and accounts with the relevant password-field configuration.

Systems using glibc rather than musl libc, or systems using PAM authentication correctly, are not affected by this particular vulnerability.

Security update released

The OpenSSH development team released version 10.6p2 on 5 November 2026, introducing a security workaround to prevent the authentication bypass.

Alpine Linux has also released updated OpenSSH packages for its supported and older branches.

Administrators should update their installations and restart the SSH daemon to ensure the patched version is running. Simply installing the updated package without restarting the service will not remove the vulnerability from an already running SSH process.

For systems that cannot immediately receive the update, Alpine recommends disabling password-based SSH authentication by setting:

PasswordAuthentication no

Administrators should ensure SSH key authentication is working before making this change to avoid losing remote access.

Potential security implications

SSH is widely used by administrators to manage Linux servers, cloud infrastructure, networking equipment and other remotely accessible systems.

A successful authentication bypass could allow attackers to gain access to accounts without knowing their passwords. Depending on the privileges of the compromised account, this could lead to further system compromise, unauthorised access to sensitive information or the installation of malicious software.

Organisations operating Alpine Linux servers should review their SSH configurations, check authentication logs for unexpected successful password logins and prioritise installing the relevant security updates.

With a high-severity rating and a relatively straightforward exploitation mechanism, CVE-2026-123158 highlights the importance of keeping remotely accessible services patched and correctly configured.

Further information

• NIST National Vulnerability Database – CVE-2026-123158
• Alpine Linux security advisory
• OpenSSH release notes – Version 10.6p2