The OpenSSH team released version 10.6p2 on November 5. It fixes CVE-2026-123158, nicknamed "SSHole", with a CVSS score of 8.1. The first attack attempt was seen less than nine hours after disclosure, and on a Previdian honeypot the attacker got root.
Not every Linux server is affected. The risk is OpenSSH built against the musl library and running without PAM. That is the default setup on Alpine Linux (3.16 through 3.24 and edge). glibc-based distributions such as Debian, Ubuntu and RHEL, and systems that use Dropbear, are not affected.
The attack needs an account with no password, meaning a "*" in the password field. Admin and service accounts that only log in with keys often look like this. The attacker sends a long password of 257 to 1,024 bytes, the password check fails with an error, and OpenSSH treats that error as a successful check.
The first job is to update OpenSSH or Alpine's fixed package and restart sshd. If you don't need password logins, setting PasswordAuthentication no in sshd_config closes this path completely. Containers that don't run sshd are not affected.
If the server has been reachable from the internet in recent days, check the logs (/var/log/messages on Alpine) for "Accepted password for" lines on key-only accounts, new users, doas use and changes to authorized_keys. If a login can't be ruled out, treat the server as compromised.
Sources: The Hacker News, Field Effect.
