CVE-2026-123158

CVE-2026-123158, dubbed *sshole, is a password authentication bypass vulnerability in OpenSSH when running on musl libc-based systems like Alpine Linux without PAM. The flaw allows an unauthenticated network attacker to log in to accounts with a shadow password field set to '*' by submitting an overlong password (longer than 256 bytes) after a failed initial attempt, exploiting how musl's crypt() function handles input length and returns values. The vulnerability affects Alpine Linux 3.16 and later, OpenWrt with OpenSSH, and other musl-based systems under specific configuration conditions, including PasswordAuthentication enabled and at least one local account with a real SHA-crypt password hash. OpenSSH released version 10.6p2 to fix the issue, and Alpine backported patches across all supported and unsupported branches.

Hackers exploited a critical vulnerability in OpenSSH, tracked as CVE-2026-123158 (CVSS score: 8.1) and codenamed SSHole, within nine hours of its public disclosure. The flaw affects Linux systems using OpenSSH with the musl C library and PAM disabled, such as Alpine Linux, allowing unauthenticated attackers to gain access to password-disabled accounts by providing an oversized password (257–1,024 bytes). Successful exploitation leads to authentication bypass, enabling attackers to gain the compromised account's permissions, potentially leading to lateral movement or data theft. Previdian confirmed successful root access on a honeypot and observed multiple exploitation attempts originating from a single IP address.