A flaw in how OpenSSH handles locked accounts on musl-based systems was exploited within two days of the fix. Who is affected and what to check.
Publicly disclosed: 5 November 2026
On 5 November 2026 OpenSSH released version 10.6p2 to fix an authentication bypass nicknamed “SSHole”. On Linux systems built on the musl C library — such as Alpine, which is widely used in containers and cloud images — accounts whose password field is set to * (meaning “no password login”) could be logged into with an oversized password. Exploitation started within hours of the public proof of concept; the first confirmed successful attack was recorded on 7 November, and CISA added the flaw to its exploited catalog on 9 November.
| CVE | Severity | Affected | Fixed in |
|---|---|---|---|
CVE-2026-123158 | High, CVSS 8.1 (authentication bypass) — exploited | OpenSSH on musl-based systems (e.g. Alpine; also embedded and router builds), under specific authentication settings | OpenSSH 10.6p2 and distribution updates |
Anyone running SSH on Alpine Linux, in containers based on Alpine, or on embedded and router firmware built with musl. Attackers who got in read password hashes and SSH keys, added their own authorized_keys, installed backdoors and cryptominers. Check your distribution's security advisory to confirm whether your systems are affected.
* password field, unknown keys in authorized_keys and unexpected services.ssh -V
# Alpine:
apk update && apk upgrade openssh
rc-service sshd restart
# check accounts with a locked "*" password hash:
awk -F: '$2=="*"{print $1}' /etc/shadowContainers are servers too — they need the same updates and the same checks.
Sources: BleepingComputer, 9 Nov 2026, CISA alert, 9 Nov 2026.
Need help with this? Contact CySec for a free consultation.
A newly disclosed exploit chain gives attackers root on on-premises N-central servers; attacks began hours after the proof of concept. No complete fix yet — immediate checks.
Read articleAn exploited Outlook flaw leaks NTLM password hashes from a crafted file. Microsoft fixed over 1,000 vulnerabilities this month — here is what to prioritise.
Read articleGoogle fixed a use-after-free in Chrome that is already exploited. The fix only works after the browser restarts — here is how to make sure every PC is protected.
Read articleOur engineers can review your current setup and propose concrete improvements.