OpenSSH released version 10.6p2 on November 5 to close a flaw that lets someone log in to certain accounts with no valid password. Previdian, a threat intelligence firm, reports that exploitation began within hours of the CVE going public, and that it gained root on an Alpine Linux honeypot.
What happened
OpenSSH’s release notes describe 10.6p2 as a critical security workaround. The project says the root cause is outside sshd, but that sshd is where it becomes exploitable. The researcher credited with the report is Özgün Kültekin of Wakefield.
According to The Hacker News, the bug works like this: an attacker sends a password between 257 and 1,024 bytes long. On the musl C library, the crypt() function refuses SHA-256 and SHA-512 hashes ($5$ and $6$) for passwords longer than 256 bytes and returns an asterisk. Accounts with no password set also store an asterisk in the shadow file. Because of a 2016 OpenSSH change that borrows another account’s salt for such accounts, the two values match and the login succeeds.
The Hacker News later reported the flaw as CVE-2026-123158 with a CVSS score of 8.1, nicknamed “SSHole.” An earlier article from November 5 said no CVE had been assigned yet, so the identifier appears to have come after the first reports.
Who is affected
Exposure requires several conditions to line up, per The Hacker News: sshd built without PAM (or PAM disabled), password authentication enabled (the default), at least one account with an asterisk in its password field, and at least one other local account with a $5$ or $6$ hash. The attacker also needs the name of a passwordless account. Alpine’s default openssh-server package is built without PAM, which is why it is the main case. Other musl-based systems may also be exposed, including OpenWrt, Buildroot and Yocto builds that run the OpenSSH server.
Not affected, as reported: Dropbear, glibc-based Linux, non-Linux systems, and setups where PAM checks passwords. Root is protected by the default PermitRootLogin setting, but a compromised passwordless user may still reach root through doas. The Hacker News says some Alpine tiny-cloud images from 3.18.11 through 3.24.3 gave the alpine user passwordless doas.
On exploitation, Previdian says its first attack observation came less than nine hours after the CVE was published. It reports eight attempts from one IP address that used oversized passwords and ran basic commands such as id, uname and hostname.
What to do
- Install OpenSSH 10.6p2 or your distribution’s patched package, then restart sshd. A package upgrade alone does not restart the running daemon.
- On Alpine, the project’s fixed point releases are 3.21.10, 3.22.8, 3.23.8 and 3.24.4, per The Hacker News. Older branches also received fixed packages. The reported command is apk upgrade -U -a followed by rc-service sshd restart.
- If you cannot patch immediately, set PasswordAuthentication to no after confirming that key-based login works, keep your current session open, run sshd -t, then restart and verify with sshd -T.
- Check logs for “Accepted password for” entries on accounts that should have no password. Our analysis: if you find one and cannot explain it, treat the host as compromised and review doas use, new users and authorized_keys files.
- Audit routers, appliances and container images built on musl that ship an OpenSSH server, since they may not be in your usual patch inventory (our analysis).
What we still do not know
Previdian’s telemetry covers a honeypot, and it has not been independently confirmed how widely the flaw is being used against production systems. No count of vulnerable or compromised servers has been published. It is also unclear how many embedded devices bundle an affected OpenSSH and musl combination, and when vendors will ship fixes for them.
Sources: OpenSSH release notes, 10.6p2 (Nov. 5, 2026); The Hacker News, Nov. 5, 2026; The Hacker News, Nov. 6, 2026.
Leave a Reply