Hackers Are Exploiting the 'SSHole' OpenSSH Flaw on Alpine Linux

A high-severity OpenSSH bug nicknamed SSHole lets attackers walk straight past password authentication, and it was being exploited within hours of going public. The catch is that it only hits a specific kind of Linux, the kind that is quietly running inside a lot more of your stack than you think.

The flaw, tracked as CVE-2026-123158, affects OpenSSH on systems that use the musl C library rather than the more common glibc. When a login attempt uses an oversized password, musl's handling of a failed password check can return a value that OpenSSH reads as a match, so the login succeeds without the right credentials. It was fixed upstream in OpenSSH 10.6p2 on 5 November, and researchers at Previdian recorded the first real exploitation attempt less than nine hours after the CVE went public. The US Cybersecurity and Infrastructure Security Agency has now added it to its Known Exploited Vulnerabilities catalogue.

Why This One Is Sneakier Than It Looks

Most Australian businesses do not run Alpine Linux on their main servers, so it is tempting to tune out. That is the trap. In the client environments we look after, musl-based Alpine almost never shows up as a server someone chose on purpose. It shows up buried inside things: a stack of Docker containers behind an off-the-shelf app, the firmware on a cheap OpenWrt router, a build image cached in a CI pipeline that no one has rebuilt in months. Those are exactly the places a scheduled patch run tends to miss, because nobody wrote them down as "a Linux box".

There is a second trap. On Alpine, the OpenSSH version string does not change when the fix is backported, so checking the version number can tell you a patched box is still vulnerable, or the reverse. You have to verify against the vendor advisory, not the number the software reports.

What To Do Now

• Find your musl systems. List every Alpine host, OpenWrt device and Docker image in your environment that runs an SSH server. This is the hard part, and the whole point.
• Kill the quick win first. Set PasswordAuthentication no in sshd_config and restart SSH. That blocks the bypass straight away while you patch.
• Patch and restart. Upgrade to OpenSSH 10.6p2 or the patched Alpine package, then restart sshd so the running service actually uses the fixed binary.
• Rebuild your images. Rebuild Alpine-based containers from current repositories, and ask whether sshd needs to be in them at all.