OpenSSH Releases Emergency Update 10.6p2 to Fix 'SSHole' Authentication Bypass Vulnerability Affecting musl-Based Linux Systems
OpenSSH released version 10.6p2 on November 5, patching CVE-2026-123158 (SSHole), a high-severity authentication bypass flaw allowing attackers to log into passwordless accounts using long password strings on systems like Alpine Linux.
The OpenSSH development team released an emergency update, version 10.6p2, on November 5, 2026, to fix a high-severity authentication bypass vulnerability named "SSHole" (CVE-2026-123158). The vulnerability has a CVSS severity score of 8.1 and allows attackers to potentially log into accounts that have no password set by entering any string between 257 and 1,024 characters in the password field during an SSH connection.
The flaw traces back to OpenSSH 7.3p1, released in 2016, meaning versions from the last decade may be affected. However, SSHole does not impact all users. It specifically affects Linux operating systems that meet three conditions: they use the musl C library, OpenSSH does not have PAM (Pluggable Authentication Modules) enabled, and SSH password authentication remains active. Major affected distributions include Alpine Linux, OpenWrt, and postmarketOS, as well as certain Docker images based on these systems.
Security research firm Wakefield identified that the vulnerability resulted from an unintended combination of security adjustments across three independent projects: musl restricted password length in 2012 to prevent denial-of-service attacks; OpenSSH modified password verification for some accounts in 2016 to avoid timing side-channel leaks; and Alpine adjusted the root account's password field settings in 2022 to facilitate SSH key login. These changes, each solving a different problem, ultimately created exploitable authentication bypass conditions. Wakefield discovered SSHole with the help of AI tools on November 3 and reported it to the relevant teams, leading to rapid patch releases from both OpenSSH and Alpine Linux.