A newly disclosed high-severity OpenSSH flaw lets an attacker sign in to password-less accounts without any valid credentials, on servers built on the musl C library.

An attacker who can reach the SSH port supplies an unusually long password, somewhere between roughly 256 and 1024 characters. On an affected host, that logs them into any account that has no password set. Key-only accounts and the default cloud user both qualify. On common Alpine images, that user can then escalate to root. SSH is usually exposed straight to the internet, so an affected host is reachable without any prior foothold in your environment.

It affects OpenSSH servers built on the musl C library, which is the default on Alpine Linux, running sshd without PAM.

What to do

• Upgrade OpenSSH to 10.6p2, or apply the patched Alpine packages released on November 5, 2026, then restart sshd.
• If you cannot patch yet, disable password authentication with PasswordAuthentication no and restart the service.
• Confirm which of your internet-facing hosts run an affected configuration.

Affected: OpenSSH sshd < 10.6p2 on musl libc without PAM (Alpine default), with password auth enabled and an account that has no password.

Not affected: glibc distros such as Debian, Ubuntu, and RHEL. PAM-based auth. Root under the default config.

For Novee customers

There is nothing to set up. Detection for CVE-2026-123158 is already built into External Surface Testing, so any external assessment you run will surface affected hosts directly in the platform. No dedicated scan to configure.

Each exposed host comes back as an issue with its severity, the evidence behind it, and remediation guidance, and you can push it straight to your ticketing integration. Novee finds the real exposure, tells you exactly how to fix it, and can verify the fix held on the next run. A public PoC is already out, though no exploitation in the wild has been confirmed yet, so confirming your own exposure now is worth the few minutes it takes.

Run an external assessment against your scope to see where you stand.

SSHhole coverage built-in

When a new CVE lands, the only reassuring answer is proof you were already testing for it.

A high-severity OpenSSH bypass, SSHhole, lets an attacker sign in to password-less accounts without any valid credentials, on servers built on the musl C library. SSH is usually exposed straight to the internet, so an affected host is reachable without any prior foothold in your environment.

Detection for CVE-2026-123158 is part of every Novee external assessment, with the affected hosts, the evidence, and the remediation already in the platform. No new scan to configure.