HIGH: OpenSSH SSHole Flaw Bypasses Authentication on musl Linux Under Active Attack

Here is a sentence nobody running Linux servers wanted to read this week. On some systems, an account that was supposed to have password login switched off could be logged into anyway. That is the short version of SSHole, an OpenSSH authentication bypass tracked as CVE-2026-123158, and attackers were already throwing it at the internet less than nine hours after the CVE went public.

The OpenSSH project shipped version 10.6p2 on November 5, 2026, with what its release notes call "a critical security workaround that affects Linux systems that use the musl libc and PAM disabled." That narrow description covers a lot of real machines. Alpine Linux uses musl, and its default OpenSSH server package is built without PAM. Alpine is the base for a huge share of container images, cloud appliances, edge boxes and small VPS deployments. If you have ever run FROM alpine in a Dockerfile, or reached for a lightweight cloud image because it booted in four seconds, you are in the blast radius until you prove otherwise.

What SSHole actually does

The flaw was found by researcher Ozgun Kultekin of Wakefield and carries a CVSS v3.1 score of 8.1 with a vector of network reachable, no privileges required, no user interaction, and full confidentiality, integrity and availability impact. The high attack complexity rating is doing a lot of work in that score, because it reflects the configuration prerequisites rather than any real difficulty once those prerequisites are met. Every OpenSSH release before 10.6p2 is affected when it runs in the vulnerable configuration.

The root cause is a little embarrassing, and it goes back a decade. In 2016, OpenSSH patched a username enumeration bug tracked as CVE-2016-6210. Attackers had been timing how long sshd took to reject a password, because real accounts took longer to hash than nonexistent ones. The fix made sshd hash a submitted password even when the target account had no usable password, which closed the timing gap. The trouble is that it also baked in a quiet assumption about what a failed hash looks like.

On musl, the password hashing routine fails under certain conditions and returns a single asterisk. That same asterisk is the conventional value stored for an account whose password login has been deliberately disabled. When those two asterisks get compared, they match, and sshd treats a failed hash as a successful authentication. The practical result is that an unauthenticated attacker can land on an account that administrators believed was locked to password login. The OpenSSH team was careful to note that the underlying cause sits outside sshd itself, but that sshd can refuse to walk into it, which is what 10.6p2 does.

There are guardrails worth understanding, because they tell you who should actually be worried. According to the Alpine Linux security advisory, a system is exposed when PasswordAuthentication is set to yes, the OpenSSH server is built without PAM or the PAM build is used with UsePAM no, at least one account has an asterisk in its password field, and at least one local account carries a modern hashed password. The bug does not override accounts that have real password hashes, and it grants only the permissions the compromised account already has. That last point sounds reassuring right up until you remember what those accounts can reach.

Why a "locked" account still ruins your day

The accounts most likely to sit with an asterisk password are exactly the ones you set up for key only access or for service use. Alpine's own tiny-cloud images, from 3.18.11 through 3.24.3, ship with an alpine user that has an asterisk password field and passwordless doas. In plain terms, an attacker who bypasses authentication into that alpine account can then escalate through doas without entering a password at all, because that is how the image was configured for convenience. One asterisk account plus one modern hash elsewhere on the box is enough to turn a disabled login into root.

Safe Security summed up the stakes well, noting that a successful SSHole attack grants access with the compromised account's existing permissions, and that from there attackers may reach deployment credentials, application secrets and connected infrastructure. That is the lateral movement story in a nutshell. The initial foothold is a low privilege service account, and the prize is everything that account was trusted to talk to.

It is already being exploited

This is not a theoretical patch now, worry later situation. The threat intelligence firm Previdian added the issue to its watchlist at 15:19 UTC on November 5, a public proof of concept appeared by 17:30 the same day, and the company's sensors observed live exploitation attempts starting just after midnight UTC on November 6. In total Previdian logged seventeen attempts from eleven unique attacker addresses spread across eight countries, and confirmed root level access on an Alpine sensor running the vulnerable OpenSSH configuration.

Ryan Dewhurst, chief executive of Previdian, described one source address using oversized passwords to bypass authentication, with the traffic geolocating to Japan. Once inside, the attacker behaved exactly like someone getting their bearings, running non interactive commands such as id, uname and hostname to understand where they had landed before deciding what to do next. That reconnaissance pattern is the window defenders have. Automated scanning gets in, then pauses to look around, and a watchful team can catch the intrusion in that gap before it turns into something worse.

What to do about it

The headline instruction is the obvious one. This is a drop everything and patch it situation if you run Alpine or any musl based Linux exposing SSH. Update OpenSSH to 10.6p2 or to your distribution's patched package, and understand that on Alpine the fixed versions vary by branch, from 10.6_p2-r0 on edge down through 10.3_p1-r2 on 3.24, 10.2_p1-r1 on 3.23, 10.0_p1-r11 on 3.22 and 9.9_p2-r1 on 3.21, with older supported branches patched to matching point releases. The critical detail that trips people up is that upgrading the package does not replace the daemon already running in memory. You have to restart sshd afterward, with rc-service sshd restart on Alpine, or the vulnerable process keeps serving connections as if nothing changed.

If you genuinely cannot patch right this minute, the effective stopgap is to turn password authentication off entirely. Set PasswordAuthentication no in a drop-in file under /etc/ssh/sshd_config.d/, validate the configuration with sshd -t, confirm the setting took with sshd -T, and restart the daemon. Verify your key based login still works before you close your current session, because locking yourself out of a remote box is its own kind of incident.

Detection comes down to reading your logs with fresh suspicion. Alpine's guidance is to search /var/log/messages for Accepted password for entries naming any account that should never authenticate by password, such as alpine, root or any key only user. Those lines are the fingerprint of this attack. You should also review recent doas usage, look for unexpected new users, and audit authorized_keys files and recently modified files on any exposed machine. One reported indicator of compromise is the source address 89.116.89.18, though with eleven attacker IPs already seen you should treat any password acceptance on a supposedly key only account as the real alarm rather than relying on a blocklist. Alpine's advice if you cannot rule out a login is blunt and correct. Treat the machine as compromised.

The business angle here is a gift for MSPs who have been trying to sell SSH key management and patch orchestration for years. SSHole is the perfect concrete example that configuration drift and forgotten service accounts are not hypothetical risks, and a quick fleet wide audit for musl based hosts, exposed SSH and asterisk password accounts makes for an easy proactive outreach to clients. Pair that with an offer for continuous external attack surface monitoring and you turn one vendor advisory into a renewed conversation about managed patching and credential hygiene.