> ## Content Index
> Fetch the complete content index at: https://stackurity.ai/blog/llms.txt
> Use this file to discover other available public pages before exploring further.

# SSHole OpenSSH flaw CVE-2026-123158 is now exploited
- URL: https://stackurity.ai/blog/sshole-openssh-cve-2026-123158-exploited-alpine/
- Published: 2026-11-10T02:05:05.000Z
- Updated: 2026-11-10T02:05:05.000Z
- Description: CISA lists the OpenSSH password bypass CVE-2026-123158 as exploited. See which Linux servers are in scope and how to update to OpenSSH 10.6p2.
- Author: Stackurity Research Team
- Tags: Actively Exploited, News

**TL;DR:** CISA now lists the OpenSSH password bypass CVE-2026-123158, nicknamed SSHole, as exploited. It affects sshd on Linux systems that use musl libc without PAM, such as Alpine Linux, and the fix is OpenSSH 10.6p2.

## What happened

BleepingComputer [reports](https://www.bleepingcomputer.com/news/security/hackers-exploit-sshole-openssh-flaw-to-breach-linux-systems/) that attackers are using the flaw to run commands, steal credentials and keep access to Linux servers. CISA added CVE-2026-123158 to its Known Exploited Vulnerabilities catalogue on November 9, 2026 and set a due date of November 12, 2026.

We covered the bug when the fix came out, in our post on [the OpenSSH long password login bypass](https://stackurity.ai/blog/openssh-flaw-long-passwords-bypass-auth-alpine-linux/). NVD says the sshd server in releases older than 10.6p2 is missing a safeguard on one kind of Linux build, the kind that pairs musl libc with no PAM. On that build, some account setups accept a very long password, and Alpine Linux is the example it names. NVD lists a CVSS v3.1 score of 8.1.

## Am I affected?

You are in scope if a server runs an OpenSSH release before 10.6p2 on a musl libc system without PAM, which includes standard Alpine Linux hosts and many container images built from Alpine that run sshd. Servers on glibc distributions such as Debian, Ubuntu or Red Hat Enterprise Linux are not the platform described. Check one machine by hand:

```
ssh -V
apk info openssh-server
ldd --version 2>&1 | head -n 1
```

If sshd is older than 10.6p2, update the package from Alpine's repositories or rebuild the image, restart sshd and limit who can reach port twenty-two until it is done. Because attackers are already using it, review authentication logs and any new keys or accounts on servers that were exposed.

## How to check with Stackurity

Stackurity reads installed packages on Linux servers, including Alpine, and in the images of running Docker containers when the agent runs with the docker option. It matches them against advisories and the CISA catalogue every hour, so the entry added on November 9 raises the finding to the top, and it can check again after the upgrade to record whether the issue is gone. Stackurity does not cover network appliance firmware, so check any appliance that embeds OpenSSH with its vendor. Read the [verification guide](https://stackurity.ai/docs/verification) for how the recheck works, or [start a free trial](https://app.stackurity.dev/signup?utm%5Fsource=blog&utm%5Fmedium=referral&utm%5Fcampaign=actively-exploited&utm%5Fcontent=sshole-openssh-cve-2026-123158-exploited-alpine).

Sources: [BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-exploit-sshole-openssh-flaw-to-breach-linux-systems/), [CISA Known Exploited Vulnerabilities catalogue](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search%5Fapi%5Ffulltext=CVE-2026-123158) and [NIST National Vulnerability Database](https://nvd.nist.gov/vuln/detail/CVE-2026-123158).