SSHole / sshhole (CVE-2026-123158)

SSHole (the researcher writes it *sshole; many write sshhole) lets an attacker log in over SSH to accounts that are meant to have no password. On Linux systems using the musl C library, such as Alpine, sshd checking passwords without PAM sends the password to musl's crypt(). An overlong password makes that call fail and return *, and an account with no password also stores *. OpenSSH compared the two, saw a match, and let the attacker in.

It affects Alpine's default openssh-server package, plus other musl systems such as OpenWrt, Buildroot and Yocto builds, which puts many containers, cloud images and small devices in scope. Debian, Ubuntu, RHEL and other glibc systems, PAM-enabled sshd and Dropbear are not affected. On Alpine, root is usually protected by the default PermitRootLogin prohibit-password; the risk is other no-password accounts, especially ones with passwordless admin rights.

OpenSSH released 10.6p2 on 5 November 2026; exploit code appeared about four hours later, attacks began the same day, and successful break-ins were reported the next. CISA added it to KEV on 9 November. Patch and restart sshd, or set PasswordAuthentication no and restart until you can.