OpenSSH: Password authentication bypass (sshole)
OpenSSH 10.6p2 addresses a password authentication bypass vulnerability affecting systems that utilize musl libc with PAM support disabled, such as Alpine Linux.
CVE search metadata
CVE search record: CVE-2026-123158. Severity: high. CVSS: 8.1. KEV: no. Product: OpenSSH (< 10.6p2), openssh-server, openssh-server-pam. Brief: OpenSSH: Password authentication bypass (sshole). Brief link: https://feed.craftedsignal.io/briefs/2026-11-openssh-auth-bypass/
Triage facts
Revision 1- Applicability
- OpenSSH (< 10.6p2), openssh-server +1
- Evidence
- Unknown
- Severity
- High
- Action
- Immediate escalation
- Sources
- 14 public sources
- Freshness
- Revision 1Nov 5, 20:26 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Likely
What's new
- 1. added CVE-2026-123158; OS alpine linux 3.21; OS alpine linux 3.24; OS alpine linux 3.19; OS alpine linux 3.20; OS alpine linux 3.22; OS alpine linux 3.23; OS alpine linux 3.16; OS alpine linux 3.17; OS alpine linux 3.18 Nov 5, 20:26 via pwn-watch
OpenSSH 10.6p2 introduces a fix for a password authentication bypass vulnerability that affects systems built and running with PAM support disabled. While the OpenSSH maintainers state the root cause lies within the underlying musl libc, the flaw is exploitable via sshd. Alpine Linux is specifically identified as a system configuration where this issue is present. This vulnerability has been referred to as "sshole" in public disclosures.
Impact
The vulnerability allows an unauthenticated attacker to bypass password-based authentication mechanisms in sshd when the system is configured to use musl libc without PAM support, potentially leading to unauthorized remote access.
Recommendation
- Upgrade OpenSSH to version 10.6p2 or later on all systems using musl libc where PAM is not enabled.
- Audit existing server configurations to determine if PAM support is disabled in current OpenSSH installations.
- Prioritize patching for Alpine Linux environments or similar distributions relying on musl libc.
Immediate actions
Upgrade OpenSSH to version 10.6p2 or later.
Threat Hunt
Identify systems in the environment running OpenSSH on musl libc distributions (e.g., Alpine Linux) where PAM is disabled.
Data: System configuration inventory, sshd_config files
Mitigations
Upgrade OpenSSH to 10.6p2 or implement PAM authentication to mitigate the vulnerability.
OpenSSH musl libc bypass