OpenSSH ships 10.6p2 for 'SSHole' auth bypass on musl systems without PAM

OpenSSH has released 10.6p2 to fix an authentication bypass that lets an attacker log in to some accounts with a very long password. SecurityWeek reported the patch on 6 November 2026. The bug is tracked as CVE-2026-123158, with a CVSS score of 8.1.

The condition is narrow. It hits sshd on Linux distributions that use musl libc with PAM disabled. A string is misread as to whether it's meant to be a password hash, and any password between 257 and 1,024 characters is accepted for certain accounts. Alpine, OpenWrt, Buildroot and Yocto are among the platforms named.

Alpine's own advisory spells out the setup: password authentication on, an account whose password field is * (root, a key-only user, the alpine user in the official tiny-cloud images, or a directory-service user via musl-nscd), and at least one local account with a $5$ or $6$ hash. Alpine says it checked releases 3.21 through 3.24 and edge, plus the older 3.16 to 3.20.

OpenSSH developer Damien Miller said the flaw isn't in sshd itself but can be exploited through it. He also said the release was rushed because AI agents have been rediscovering bugs within hours, making long embargoes a bad trade.

Nobody has reported exploitation yet. Fredrik Almroth of Detectify expects scanning to start quickly, since each attempt is a single connection. Jake Knott of WatchTowr said he'd be surprised not to see brute-forcers trying it by the weekend.

If you run Alpine or another musl build without PAM, patch and restart sshd, or turn off password logins and restart. Then check whether any account still has a * password field alongside a $5$ or $6$ hash elsewhere on the box.

CVE references

CVE-2026-123158