CVE-2026-123158 (*sshole): OpenSSH Password Authentication Bypass on Alpine Linux

CVE-2026-123158, dubbed *sshole, is a password authentication bypass vulnerability in OpenSSH when running on musl libc-based systems like Alpine Linux without PAM. The flaw allows an unauthenticated network attacker to log in to accounts with a shadow password field set to '*' by submitting an overlong password (longer than 256 bytes) after a failed initial attempt, exploiting how musl's crypt() function handles input length and returns values. The vulnerability affects Alpine Linux 3.16 and later, OpenWrt with OpenSSH, and other musl-based systems under specific configuration conditions, including PasswordAuthentication enabled and at least one local account with a real SHA-crypt password hash. OpenSSH released version 10.6p2 to fix the issue, and Alpine backported patches across all supported and unsupported branches.

AI-extracted · verify before operational use