--- title: SSHhole (CVE-2026-123158) and how IONIX is helping you... description: CVE-2026-123158 is a high-severity (CVSS 8.1) SSH password authentication bypass affecting Linux systems where sshd is linked against musl libc without PAM,... canonical: https://daily.dev/posts/sshhole-cve-2026-123158-and-how-ionix-is-helping-you-respond-itsbjdova twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: SSHhole (CVE-2026-123158) and how IONIX is helping you respond | daily.dev og:description: CVE-2026-123158 is a high-severity (CVSS 8.1) SSH password authentication bypass affecting Linux systems where sshd is linked against musl libc without PAM,... og:url: https://daily.dev/posts/sshhole-cve-2026-123158-and-how-ionix-is-helping-you-respond-itsbjdova og:image: https://api.daily.dev/og/posts/itsbJDoVA.png og:image:alt: SSHhole (CVE-2026-123158) and how IONIX is helping you respond og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # SSHhole (CVE-2026-123158) and how IONIX is helping you respond **[Security Boulevard](https://daily.dev/sources/securityboulevard)** · 7 min read · 0 upvotes · 0 comments ## Summary CVE-2026-123158 is a high-severity (CVSS 8.1) SSH password authentication bypass affecting Linux systems where sshd is linked against musl libc without PAM, most notably Alpine Linux. Against an account with no password set, any password between 256 and 1024 characters is accepted. The bug comes from musl's crypt() function returning '*' for overly long passwords, which matches the '*' stored for passwordless accounts. It's fixed in OpenSSH 10.6p2, released November 5, 2026, and in patched Alpine packages on every supported branch. glibc-based distributions like Debian, Ubuntu, and RHEL are not affected, nor is sshd running with PAM. Fix: upgrade OpenSSH and restart sshd, or set PasswordAuthentication no as an interim measure. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-123158 and which systems does it affect? CVE-2026-123158 is a password authentication bypass in sshd affecting Linux systems where sshd is linked against musl libc and runs without PAM, most notably Alpine Linux. It has a CVSS 3.1 score of 8.1 (High). Against an account with no password set, any password between 256 and 1024 characters is accepted. Debian, Ubuntu, RHEL, and other glibc distributions are not affected, nor is sshd running with PAM enabled. _Teams running Alpine-based containers can track fast-moving CVEs like this one on daily.dev._ ### Why does musl's crypt() function cause an SSH authentication bypass? musl's crypt() function returns the string '*' to signal an error when a supplied password exceeds 256 bytes. Accounts with no password set often store exactly '*' in the password field of /etc/shadow, so sshd compares the two strings, finds them equal, and accepts the login. OpenSSH 10.6p2 fixes this by rejecting stored password hashes shorter than 4 characters. _Developers debugging musl-based auth quirks follow root-cause writeups like this on daily.dev._ ### How do I fix or mitigate CVE-2026-123158 on Alpine Linux? Upgrade to OpenSSH 10.6p2 or your Alpine branch's patched package (for example 10.3_p1-r2 on Alpine 3.24) with 'apk upgrade -U -a', then restart sshd since upgrading alone does not restart a running service. If you cannot patch immediately, set 'PasswordAuthentication no' and 'KbdInteractiveAuthentication no' in sshd_config and reload sshd after confirming key-based access works. _Admins patching Alpine fleets under deadline pressure track fixes like this via daily.dev._ ## Similar posts on daily.dev - [libssh2 CVE-2026-55200 Shows Why Outbound SSH Is an Attack Surface](https://daily.dev/posts/libssh2-cve-2026-55200-shows-why-outbound-ssh-is-an-attack-surface-pza5y7nfo) · Latest Hacking News · 1 upvotes · 0 comments - [Critical Remote Code Execution Vulnerability in libssh2 Client Library Require Urgent Mitigation](https://daily.dev/posts/critical-remote-code-execution-vulnerability-in-libssh2-client-library-require-urgent-mitigation-uak3prjwd) · Arctic Wolf · 0 upvotes · 0 comments - [SSHStalker botnet brute-forces its way onto 7,000 Linux machines](https://daily.dev/posts/sshstalker-botnet-brute-forces-its-way-onto-7-000-linux-machines-d1nrvsgyf) · CSO Online · 14 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ssh](https://daily.dev/tags/ssh) [View this post on daily.dev](https://daily.dev/posts/sshhole-cve-2026-123158-and-how-ionix-is-helping-you-respond-itsbjdova) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"SSHhole (CVE-2026-123158) and how IONIX is helping you respond","url":"https://daily.dev/posts/sshhole-cve-2026-123158-and-how-ionix-is-helping-you-respond-itsbjdova","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/sshhole-cve-2026-123158-and-how-ionix-is-helping-you-respond-itsbjdova"},"datePublished":"2026-11-05T18:59:25.032Z","dateModified":"2026-11-06T02:51:38.062Z","description":"CVE-2026-123158 is a high-severity (CVSS 8.1) SSH password authentication bypass affecting Linux systems where sshd is linked against musl libc without PAM,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8fe9eeb967de205fd6743e2535f16178?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8fe9eeb967de205fd6743e2535f16178?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Security Boulevard","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Security Boulevard","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/3613c832180040de8d85bb29f74395be","url":"https://daily.dev/sources/securityboulevard"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/sshhole-cve-2026-123158-and-how-ionix-is-helping-you-respond-itsbjdova","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ssh","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Security Boulevard","item":"https://daily.dev/sources/securityboulevard"},{"@type":"ListItem","position":3,"name":"SSHhole (CVE-2026-123158) and how IONIX is helping you respond"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/sshhole-cve-2026-123158-and-how-ionix-is-helping-you-respond-itsbjdova#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-123158 and which systems does it affect?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-123158 is a password authentication bypass in sshd affecting Linux systems where sshd is linked against musl libc and runs without PAM, most notably Alpine Linux. It has a CVSS 3.1 score of 8.1 (High). Against an account with no password set, any password between 256 and 1024 characters is accepted. Debian, Ubuntu, RHEL, and other glibc distributions are not affected, nor is sshd running with PAM enabled. Teams running Alpine-based containers can track fast-moving CVEs like this one on daily.dev."}},{"@type":"Question","name":"Why does musl's crypt() function cause an SSH authentication bypass?","acceptedAnswer":{"@type":"Answer","text":"musl's crypt() function returns the string '*' to signal an error when a supplied password exceeds 256 bytes. Accounts with no password set often store exactly '*' in the password field of /etc/shadow, so sshd compares the two strings, finds them equal, and accepts the login. OpenSSH 10.6p2 fixes this by rejecting stored password hashes shorter than 4 characters. Developers debugging musl-based auth quirks follow root-cause writeups like this on daily.dev."}},{"@type":"Question","name":"How do I fix or mitigate CVE-2026-123158 on Alpine Linux?","acceptedAnswer":{"@type":"Answer","text":"Upgrade to OpenSSH 10.6p2 or your Alpine branch's patched package (for example 10.3_p1-r2 on Alpine 3.24) with 'apk upgrade -U -a', then restart sshd since upgrading alone does not restart a running service. If you cannot patch immediately, set 'PasswordAuthentication no' and 'KbdInteractiveAuthentication no' in sshd_config and reload sshd after confirming key-based access works. Admins patching Alpine fleets under deadline pressure track fixes like this via daily.dev."}}]} ```