Last reviewed
Patch*sshole: OpenSSH password bypass on musl Linux
CVE-2026-123158
An authentication bypass in OpenSSH's sshd on musl-based Linux without PAM, including Alpine's default package, lets attackers log in to accounts with no password set.
Risk
With password logins enabled, an unauthenticated attacker can log in to passwordless accounts if another account has a $5$ or $6$ hash. Neither OpenSSH nor Alpine had reported exploitation as of November 6.
Recommended action
Update OpenSSH to 10.6p2 or your distribution's fixed package, then restart sshd. If you cannot update yet, set PasswordAuthentication no and restart sshd.