OpenSSH has urgently released patches for a high-severity authentication vulnerability that allows attackers to log in using very long passwords. Dubbed SSHole and listed under the identifier CVE-2026-123158, with a CVSS score of 8.1 (a scale for measuring vulnerability severity), it affects the OpenSSH server (sshd).
- OpenSSH publie en urgence des correctifs contre SSHole, une faille critique (CVE-2026-123158) permettant de se connecter avec de très longs mots de passe.
- Seules les distributions Linux utilisant musl libc, avec PAM désactivé, sont touchées.
- Les attaquants peuvent accéder à des comptes qui ne devraient jamais accepter de mot de passe, comme root, avec un mot de passe de 257 à 1 024 caractères.
- Alpine Linux recommande d’appliquer les correctifs immédiatement ou de désactiver l’authentification par mot de passe, car des scans pourraient commencer dans les heures qui suivent.
A confusion over passwords
According to the vulnerability description, the SSH server, which allows remote connection to a machine, only affects Linux distributions that use the musl libc library and have the PAM (Pluggable Authentication Module, a component responsible for managing authentication) disabled. The flaw stems from a “misinterpretation” of whether a character string is intended to be a password hash, i.e., an encoded version of the password. In this case, attackers can access certain accounts with any password containing between 257 and 1,024 characters.
The issue notably concerns accounts that should never accept a password, such as the root account, which fully administers a system. However, in distributions like Alpine, OpenWrt, Buildroot, or Yocto, notes security researcher Özgün Kültekin, these accounts accept a password.
OpenSSH developer Damien Miller clarifies that the vulnerability is not in sshd itself, but it can be exploited via sshd. The patches are included in OpenSSH version 10.6p2.
An accelerated release
Damien Miller justifies the speed of the release: “We are releasing this version as quickly as possible (we discovered the issue yesterday) because we have recently observed several cases of AI agents quickly rediscovering bugs, sometimes within hours. We therefore consider long embargo periods to be a dangerous practice, which primarily benefits attackers.”
For its part, Alpine Linux has asked its users to immediately apply the OpenSSH patches and restart sshd, or to disable password logins and then restart the service. The distribution specifies that an attacker must know the name of an account whose password field is “*”, which is normal for accounts accessible only by key, and that the machine must have at least one other account with a password hash starting with $5$ or $6$.
Alpine Linux indicates that all checked versions are affected, from 3.21 to 3.24 as well as the edge branch, as well as older versions that no longer receive regular updates, from 3.16 to 3.20. It also emphasizes: “An attacker who can reach your SSH port can log in without knowing any password. It only takes one connection, it works every time and no retry is necessary.”
An exploitation risk to monitor
Alpine Linux states that it has not yet received any reports of exploitation. However, Detectify co-founder and principal security researcher Fredrik Almroth believes that, with the details public and the attack simple, scanning could begin within hours. He notes that Shodan lists about 22 million systems with SSH port 22 open, a figure he considers lower than reality, and that each attempt requires only a single connection.
Jake Knott, Threat Intelligence Lead at WatchTowr, for his part, finds it “extremely surprising” not to see brute-force attack attempts by the weekend. He recommends, if possible, updating to the latest version and, in the meantime, disabling password authentication.
