*sshole

CVE-2026-123158 is a password authentication bypass in Portable OpenSSH sshd on Linux when sshd is linked against musl libc and PAM is off. MITRE published the CVE at 15:46 UTC on 5 Nov 2026 (reserved the same minute). CNA score: CVSS 3.1 8.1 High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). CWE-394. NVD API (checked 5 Nov 2026): vulnStatus Received, published 16:17 UTC, lastModified 18:17 UTC. Secondary CNA metric only; no NVD-produced Primary. FIRST EPSS had no row on 5 Nov 2026.

OpenSSH 10.6p2 (5 Nov 2026) calls this a critical security workaround for Linux systems that use musl libc with PAM disabled. The project says the root cause sits outside sshd, but the bypass is reachable through sshd and can be avoided there. Alpine (5 Nov 2026): when sshd is built without PAM it hashes a password attempt with crypt() and compares the result to the stored field. For a field too short to hold a salt, sshd borrows another account's salt. musl crypt() returns * when the key is over 256 bytes. * is also the stored field for accounts with no password, so the comparison succeeds. This page stays high level. It does not give password-construction detail beyond an oversized password.

A host is in scope only when every precondition holds, from Alpine and the researcher. sshd is musl-linked. PAM is off (Alpine openssh-server default, or UsePAM no). PasswordAuthentication is yes (OpenSSH default unless changed). An account that can log in has shadow field exactly *. Another local account has a $5$ or $6$ hash. Network reach to the SSH port. Alpine gives 257 to 1024 bytes and the researcher and The Register 257 to 1,024 characters; the CVE record says 256 to 1024 characters. Both wordings are dated 5 Nov 2026. Locked accounts with ! are out of Alpine's scope. OpenSSH's default PermitRootLogin prohibit-password keeps root from a password login unless that setting is yes; Alpine notes that does not help if another reachable account can become root, for example through doas.

Fix: Portable OpenSSH 10.6p2, and Alpine's backported packages on every branch from 3.16 (table below). Upgrading the package does not replace a running sshd. Alpine: apk upgrade -U -a, then rc-service sshd restart. Point releases 3.21.10, 3.22.8, 3.23.8, and 3.24.4 ship the fix. Alpine 3.21 reached end of support on 1 Nov 2026. Alpine still published fixed packages for each release back to 3.16, including 3.16 to 3.20. Alpine's advisory said no CVE identifier had been assigned at the time of writing. The MITRE record landed later the same day.

Exploitation: Help Net Security (6 Nov 2026) quotes Previdian founder Ryan Dewhurst: sensors picked up attacks, and at least one got all the way in. Dewhurst said the first observed attempt arrived less than nine hours after CVE publication, and Previdian saw successful root access on a honeypot running real Alpine Linux and OpenSSH. Source IP 89.116.89[.]18 (described as Japan-based) used oversized passwords and ran id, uname, and hostname through non-interactive SSH sessions. Eight attempts, all from that address, all on one sensor. Previdian's live CVE record (fetched 6 Nov 2026) lists attempts from 3 IPs (CH, JP, SG) on 1 sensor and says sensors do not show the target was vulnerable or that the attempt succeeded. Live attempt totals on that page have moved between fetches on the same day, so this page does not cite a precise Previdian attempt count. The Hacker News (6 Nov 2026) recaps that Previdian report with the same less-than-nine-hours wording. watchTowr Intel (6 Nov 2026, 09:28 UTC / 17:28 SGT) separately reports observing exploitation; the post says: for now, it's botnets and crypto miners. Security.NL (6 Nov 2026) reports the same watchTowr observation. Do not merge Previdian's single-sensor honeypot with watchTowr. SANS ISC (Johannes Ullrich, diary published 8 Nov 2026, last updated 2026-11-08 15:44:33 UTC) reports that ISC Cowrie honeypots saw the first sshole exploit attempts on 5 Nov 2026, earlier than Previdian's first-observed attempt on 6 Nov. Long-password attempts: 232 on 5 Nov, 713 on 6 Nov, 246 on 7 Nov, 51 on 8 Nov. Long passwords seen on 1 Nov were judged not related to this exploit (buggy brute-force scripts). Cowrie keeps only the first 255 password characters, which limits attribution. These are honeypot attempts, not production compromises. SANS Stormcast on 9 Nov 2026 is related coverage of that diary. BleepingComputer (Bill Toulas, 9 Nov 2026) quoting GreyNoise: first successful exploitation at 00:46 UTC on 7 Nov 2026; 16 exploitation chains; one TAC Agent implant with C2 tac.vpnla[.]org. Defused reported small-scale activity, not widespread. This page does not publish victim counts or campaign names from the Previdian or watchTowr reports. The C2 is a single reported indicator via BleepingComputer/GreyNoise, not a complete IOC set. Badge: confirmed exploited (CISA KEV, 9 Nov 2026). The Register (5 Nov 2026, 18:29 UTC) had written there was no indication vulnerable systems had been exploited; that 5 Nov check is superseded. CISA listed CVE-2026-123158 in KEV on 9 Nov 2026 (catalog 2026.11.09, released 2026-11-09T16:16:16.4275Z, due 12 Nov 2026; knownRansomwareCampaignUse Unknown; forensicTriage Yes; CWE-394). Previdian listed the CVE on its own known-exploited feed (Sensors First, 2026-11-06 09:53 UTC); that feed is not CISA KEV. CISA ADP (17:18 UTC on 5 Nov) tagged sshhole.com as an exploit reference and set SSVC Exploitation to poc. That is a PoC assessment, not an in-the-wild mark. Help Net Security says proof-of-concept exploits have been posted on GitHub; Previdian cautions they are unverified and could contain malware. This page does not index those links. Researcher-hosted interactive labs remain public at sshhole.com. This page indexes that lab only and does not copy exploit code.

Credit: Özgün Kültekin (Wakefield) reported it. OpenSSH credits that report. Alpine thanks Damien Miller and Darren Tucker for the fix and the 10.6p2 release, Timo Teräs for analysis help, and Natanael Copa for the packages.