OpenSSH Patches ‘SSHole’ Authentication Bypass on Linux Systems Using musl libc

OpenSSH has rolled out emergency patches for a high-severity authentication bypass, dubbed SSHole and tracked as CVE-2026-123158 with a CVSS score of 8.1. The defect affects the OpenSSH server (sshd) on Linux distributions that use the musl libc implementation with the Pluggable Authentication Module (PAM) disabled. According to SecurityWeek, a misinterpretation of whether a string is intended to be a password hash allows attackers to access certain accounts using any password between 257 and 1,024 characters long. Fixes are included in OpenSSH 10.6p2.

OpenSSH developer Damien Miller said the flaw is not in sshd itself but can be exploited via sshd. He said the release was made as fast as possible because the project had learned of the problem the previous day and had recently observed multiple cases of rapid bug rediscovery by AI agents, sometimes within hours. Alpine Linux urged users to apply the patches and restart sshd, or to disable password logins and restart sshd. Alpine said every release it checked, from 3.21 through 3.24 and edge, is affected, as are the older releases 3.16 to 3.20 that no longer receive regular updates.

Detectify co-founder and principal security researcher Fredrik Almroth said that the attack is simple and that he expects scanning to start within hours, while noting that no exploitation reports had been seen yet. WatchTowr head of threat intelligence Jake Knott advised organizations to update where possible and to disable password-based authentication as a temporary mitigation if they cannot update.

Why it matters Any Linux host running sshd without PAM on musl libc, including Alpine, OpenWrt, Buildroot and Yocto systems, should be checked for accounts with a * password field and for local accounts with a $5$ or $6$ hash. Because the attack needs one connection and public details exist, administrators should apply OpenSSH 10.6p2 or the distribution fix, or disable password logins as a temporary measure. Our analysis is that exposed SSH services are the first place to look, since scanning is expected to begin quickly.