OpenSSH's maintainers pushed out an emergency release on Nov. 5 after a researcher found a way to log into Linux accounts that have no usable password at all — no credentials, no key, just a specially crafted connection attempt. The bug, formally CVE-2026-123158 and nicknamed "SSHole" by the researcher who found it, Özgün Kültekin, carries a severity score of 8.1.
The flaw is narrow but real. It only affects OpenSSH running on systems that use the musl C library instead of the more common glibc, and that check passwords without going through PAM, the standard Linux authentication framework — a combination that happens to be Alpine Linux's default server setup. Systems using glibc, PAM, Dropbear or OpenBSD are not affected, and some OpenWrt, Buildroot, Yocto and Docker builds are worth checking too.
The gap between disclosure and exploitation was almost nonexistent. Ryan Dewhurst, founder of the security firm Previdian, said his company's honeypot — an Alpine Linux box running OpenSSH and deliberately left exposed to catch attackers — was successfully logged into with no password less than nine hours after the vulnerability was published, confirming the bug could be used to gain full root access.
This vulnerability was particularly trivial to exploit, which significantly shrunk that timeline.
Ryan Dewhurst, founder, Previdian
OpenSSH developer Damien Miller urged administrators not to wait for a convenient moment to patch. "Stop reading and set PasswordAuthentication=no or disable SSH for these systems IMMEDIATELY," he wrote on Mastodon shortly after the disclosure — a message the Alpine Linux project echoed in its own advisory: "An attacker who can reach your SSH port can log in without knowing any password." By Nov. 9, the threat-intelligence firm GreyNoise said it had tracked exploitation attempts from multiple sources beyond Previdian's original sighting, and the bug was added to the U.S. government's Known Exploited Vulnerabilities catalog.
Alpine has shipped patched packages across its supported branches, and the fix is included in OpenSSH 10.6p2. Administrators who can't upgrade immediately are advised to disable password authentication or take affected systems off the network, and to check logs for suspicious "Accepted password" entries on accounts that were never supposed to have one. Security researchers say the episode is a reminder that niche configurations, however rare, can still leave a widely used tool like OpenSSH badly exposed.
