SSHole CVE-2026-123158: Check Alpine Servers Now

DEV Community

SSHole (CVE-2026-123158): Check Every Alpine Server and Image That Runs sshd

On November 9, 2026, CISA added CVE-2026-123158 to its Known Exploited Vulnerabilities catalog. The bug, nicknamed "SSHole", lets an attacker log in over SSH with a long junk password on some Linux systems that use the musl C library without PAM. Alpine Linux is the main example, and Alpine is a common base for Node.js containers and small cloud servers. Most SaaS teams on managed platforms will not be affected. Teams that run their own Alpine hosts, bastions or containers with an SSH server inside should check today, because exploitation started within hours of disclosure. What Happened OpenSSH released portable OpenSSH 10.6p2 on November 5 with what the project calls a critical security workaround. The release notes say sshd could be used to bypass password authentication on some Linux systems built and run with PAM disabled. The OpenSSH developers consider the root cause to lie outside sshd, but it is exploitable through sshd and is now blocked there. Alpine shipped patched packages the same day. Researchers' write-ups describe three choices that combine badly (OX Security's analysis): musl's crypt() rejects passwords longer than 256 bytes and returns . Linux uses * in /etc/shadow to mean "this account has no valid password". Since 2016, sshd hashes a password attempt using another account's hash settings when the target account has no usable hash, to make user enumeration harder. On an affected system, a password between roughly 256 and 1,024 characters makes the comparison * against , and the login succeeds. Alpine's tracker describes the same window: any password in that range succeeds for some account configurations. Help Net Security reported that the threat-intelligence firm Previdian saw a first attempt less than nine hours after the CVE was published, and that an Alpine honeypot gave the attacker root. The scale of exploitation beyond those reports is not public. The KEV listing confirms CISA has evidence of active exploitation. Who Is Affected According to the write-ups linked above, every one of these conditions must hold: sshd from OpenSSH before 10.6p2 runs on a musl-based Linux system (Alpine, OpenWrt, Buildroot, Yocto and images built from them); PAM is not used. Alpine's openssh-server package does not use PAM by default; password authentication is enabled, which is the OpenSSH default; at least one account has * in its password field (on Alpine, root has had * since about 3.16; key-only deploy users and LDAP users often do too); at least one other account on the same system has a real password hash. The reports single out Alpine cloud images on AWS and Azure. Their default alpine user is passwordless and can run doas without a password, so a login there can become root. The images are reported to become exploitable once any real password hash exists, for example after someone sets a console password. Not affected, per the same sources: glibc distributions such as Debian, Ubuntu, Fedora and RHEL, systems where sshd uses PAM, Dropbear, OpenBSD, accounts locked with !, and any system with PasswordAuthentication no. For a typical SaaS stack, that means: Vercel, Cloudflare Workers and similar platforms: you do not run sshd there, so there is nothing for you to patch (my inference; no provider has published a statement). Node.js containers on node:-alpine: the official images do not include an SSH server. You are exposed only if your Dockerfile adds openssh-server and starts it. Self-managed Alpine VMs, bastions and jump hosts: the highest-risk group. Check these first. GitHub-hosted Actions runners: these run Ubuntu, Windows or macOS, not musl. What to Do Today List hosts that accept SSH and run Alpine or another musl system. Include bastions, small utility VMs and anything built from an Alpine cloud image. Search infrastructure code for Alpine image IDs too. Search your Dockerfiles for an SSH server. Run grep -rniE "openssh|sshd" --include="Dockerfile" . across your repositories. For a built image, run d...

Powered by Readybot.io