CISA Flags SSH Flaw CVE-2026-123158 in Alpine Linux Systems Under Active Exploitation

CISA added CVE-2026-123158, nicknamed "SSHole", to its Known Exploited Vulnerabilities catalog on November 9, 2026, citing evidence of active attacks. The flaw lets an attacker log in over SSH using a long password on certain Linux systems that use the musl C library without PAM, with Alpine Linux as the main example. The problem stems from musl's crypt() rejecting passwords over 256 bytes and returning "*", which matches the "*" placeholder on accounts without valid passwords. OpenSSH released version 10.6p2 on November 5 with a workaround, and Alpine shipped patched packages the same day. Researchers reported an attempt less than nine hours after disclosure, and managed platforms are largely unaffected, while self-managed Alpine hosts and containers running an SSH server face the greatest risk.