OpenSSH CVE-2026-123158 Flaw Hits Alpine Linux: Patch to 10.6p2

A newly disclosed OpenSSH flaw, tracked as CVE-2026-123158, lets an attacker log in to certain Linux servers without knowing the password — no brute force, no phishing, just a single long string typed into any password prompt. The bug only hits systems built on musl libc that run sshd without PAM, which in practice means Alpine Linux and the countless musl-based Docker and cloud images built on top of it. OpenSSH shipped a fix in version 10.6p2 on November 5, 2026, and Alpine has already published patched packages for every supported branch going back to 3.16. If you run Alpine servers, Alpine-based containers, or any other musl/no-PAM Linux box with sshd exposed, the short version is: run apk upgrade -U -a, restart sshd, and check your logs today.

What is CVE-2026-123158?

CVE-2026-123158 is a password authentication bypass in sshd, the SSH daemon that ships with OpenSSH. According to the official CVE record published by the CVE Program on November 5, 2026, the bug affects "sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM," and for some account configurations, "any password between 256 and 1024 characters succeeds." That is about as close to an authentication bypass as a vulnerability gets without actually being one on paper: the attacker still "enters a password," but almost any sufficiently long string will do.

The flaw carries a CVSS 3.1 base score of 8.1 (High), with a vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, no privileges or user interaction required, and a total loss of confidentiality, integrity and availability if exploited. The "attack complexity: high" rating reflects the specific preconditions needed (detailed below), not any difficulty in crafting the exploit itself. For background on how vulnerability identifiers and severity scores are assigned, how CVE numbers and CVSS scores work is worth a read.

The issue was found by researcher Özgün Kültekin of security firm Wakefield, and fixed by OpenSSH maintainers Damien Miller and Darren Tucker, with analysis help from Alpine's Timo Teräs. OpenSSH's own release notes are notably blunt about where they think the fault really lies: the maintainers say they "consider the root cause of this bug to be outside sshd," but added a workaround anyway because so many Linux distributions run sshd without PAM.

How the musl libc authentication bypass actually works

The root cause sits in how sshd checks a typed password when it has no PAM stack to delegate to. In that mode, sshd calls the C library's crypt() function on whatever the user typed and compares the result, byte for byte, against the hash stored in /etc/shadow. On musl libc — the lightweight standard library used by Alpine Linux instead of glibc — crypt() has a quirk: if the supplied password is longer than 256 bytes, it returns the literal string * as an error indicator instead of a hash or an error code.

That would be harmless on its own, except accounts that have no password set — service accounts, key-only logins, or anything created with usermod -p '*' — also store the literal string * in their password field. When sshd compares the error output to the stored field, the two * values match, and the login is accepted as though a correct password had been entered. Alpine's advisory adds one more wrinkle: for accounts whose stored field is too short to contain a proper salt, sshd ends up borrowing the salt from a different account on the same system, which is why the bug also needs at least one other local account with a standard $5$ or $6$ password hash present to be exploitable.

Put together, an attacker who can reach port 22 on a vulnerable box needs only two things to be true of the target: an account with a * password field, and some other account on that machine with a real password hash. Any password string between roughly 257 and 1024 bytes long then logs them straight in — reliably, on the first attempt, with no guessing involved.

Who is actually at risk

This is not a "every Linux server on earth" bug, but it is a lot broader than it first sounds, because Alpine's tiny footprint makes it the default base image for an enormous share of containerized and embedded Linux deployments. Alpine's own advisory lays out the exposure in detail:

• Root accounts ship as root:* by default. They're normally shielded by the default PermitRootLogin prohibit-password setting — but not if an administrator has changed that to PermitRootLogin yes, or if another account can reach root through doas.
• Key-only user accounts, created without a password or via usermod -p '*', are directly exploitable.
• Directory-service accounts served through musl-nscd integrations such as nslcd, Winbind, or SSSD can also present a vulnerable password field.
• The default alpine user in official Alpine tiny-cloud images (versions 3.18.11 through 3.24.3) ships with a * password and passwordless doas by default, becoming exploitable the moment any account with a $6$ hash exists on that instance.

Systems that are not affected include containers that never run sshd at all, any host with PasswordAuthentication no already set, the openssh-server-pam package when UsePAM yes is configured, properly locked accounts (whose password field is !, not *), boxes with no $-style password hash anywhere on the system, and cloud-init images, which set PasswordAuthentication no out of the box. That still leaves a wide swath of self-managed Alpine VMs, bare-metal routers and NAS appliances, and Alpine-based CI/build images exposed by default. OpenSSH itself remains maintained by the OpenBSD project, which ships the portable version used across almost every Linux distribution, Alpine included.

Is CVE-2026-123158 being actively exploited?

Not confirmed yet, and it's worth being precise about that. CISA's own vulnerability enrichment data for this CVE currently lists the exploitation status as "PoC" (proof-of-concept exists) rather than "active," and as of this writing CVE-2026-123158 has not appeared in CISA's Known Exploited Vulnerabilities (KEV) catalog, which is reserved for flaws CISA has confirmed are being used in real attacks. That's a meaningfully different situation from, say, a genuine zero-day vulnerability exploited before any patch exists — here, the coordinated disclosure, OpenSSH's fix, and the CVE publication all landed within the same day.

That said, "no confirmed exploitation" is not the same as "safe to ignore." Working proof-of-concept exploit code and reproduction labs are already circulating publicly on GitHub, and the bug requires no authentication, no user interaction, and no more than a single SSH connection attempt to try. Given how quickly PoC code for simple, high-impact authentication bugs tends to get folded into mass internet scanning, treating this as "patch this week" rather than "patch this quarter" is the sane read.

How to patch CVE-2026-123158

For Alpine Linux systems, the fix ships through the normal package manager. Alpine's advisory recommends:

1. Run apk upgrade -U -a to pull the fixed openssh package.
2. Restart the daemon with rc-service sshd restart. Upgrading the package alone does not replace the already-running sshd process, so this step is not optional.
3. Rebuild and redeploy any container images built from an affected Alpine base, since the fix has to be baked into the image, not just applied to a running container.

Notably, Alpine 3.21 officially reached end of support on November 1, 2026, just days before this advisory — yet fixed packages were still published back to it and every older branch down to 3.16. Outside Alpine, any other Linux distribution or custom build that compiles OpenSSH against musl libc without PAM should upgrade to upstream OpenSSH 10.6p2 directly. Administrators managing a mixed fleet of network gear that also runs stripped-down Linux builds may recognize the pattern: it's the same patch-now urgency that pushed MikroTik to rush RouterOS fixes after routers running lean, non-standard Linux stacks turned out to be exposed to a different flaw.

Workaround if you can't patch immediately

If upgrading isn't an option right away — a locked-down production system, a vendor appliance you don't control, or a fleet too large to patch same-day — Alpine's advisory describes a workaround: disabling password authentication entirely. Since the bug only triggers when sshd falls back to its own password check, turning that check off closes the hole regardless of patch level.

In practice that means adding PasswordAuthentication no to a drop-in file under /etc/ssh/sshd_config.d/, validating the configuration with sshd -T, and restarting sshd — while keeping an existing SSH session open until you've confirmed key-based login still works, in case the config change goes wrong. This is a mitigation, not a fix, and it should be reverted once the real package upgrade is rolled out.

How to check if you were already exploited

Because a successful exploit looks, from the server's point of view, like a normal successful password login, detection comes down to log review rather than any special alert. Alpine's advisory recommends checking /var/log/messages (or the equivalent syslog location) for Accepted password for entries tied to accounts that should never accept a password at all — the alpine cloud-image user, root, or any key-only service account. Administrators should also review recent doas usage, look for newly created local users, and check whether any authorized_keys files were modified around the same time as a suspicious login. If a password login on a passwordless account can't be explained, Alpine's own guidance is blunt: treat the host as compromised and respond accordingly, rather than assuming it was a fluke.

Why a musl/Alpine bug matters beyond Alpine's own servers

It's tempting to read this as a niche distro issue, but Alpine's minimal size is exactly why it has become the default base image for a huge share of the container ecosystem — official Docker images, CI runners, Kubernetes sidecars, and IoT and router firmware builds frequently choose Alpine specifically because it's small and musl-based. Any organization running SSH-accessible Alpine VMs, cloud instances built from Alpine's tiny-cloud images, or custom-built appliances on musl without PAM inherits this exposure whether or not "Alpine Linux" appears anywhere in their asset inventory. That's also why this is a useful case study in reading a CVE correctly: the headline "password bypass, CVSS 8.1" sounds like it should hit everyone running SSH, but the actual blast radius is defined by a fairly specific combination of libc, PAM configuration, and account setup — details that only show up if you read past the CVSS score into the advisory itself.

What to do next

If you administer Alpine Linux systems, Alpine-based containers, or any other Linux host that pairs musl libc with sshd running outside PAM, this belongs on this week's patch list, not next quarter's. Run the upgrade, restart sshd, rebuild any container images that bake in the old package, and spend ten minutes checking authentication logs for anomalies before you consider it closed. Given that proof-of-concept code is already public and the vulnerability requires nothing more than a single long string typed at a login prompt, the gap between "patch available" and "mass scanning begins" is likely to be short.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage