The OpenSSH sshole flaw, CVE-2026-123158, lets a remote attacker log in to some accounts on Linux systems that run sshd on musl libc without PAM. OpenSSH 10.6p2, released on 5 November 2026, fixes it. Alpine Linux is the example the CVE record names, and Synology says none of its products are affected.
OpenSSH calls the fix a critical security workaround and says it considers the root cause to be outside sshd. The CVE record scores the flaw 8.1 on CVSS 3.1 (High), with no CVSS 4.0 score in the record or NVD. NVD listed the record as Received on 6 November 2026.
What Is the OpenSSH Sshole Flaw and Who Is Exposed?
Alpine’s advisory explains the mechanism. Without PAM, sshd checks a password by hashing it with the C library’s crypt function and comparing the result with the stored field. On musl, crypt returns a single star when the password is over 256 bytes, and a star is also what the stored field holds for an account with no password. The CVE record says that for some account configurations, any password between 256 and 1024 characters succeeds.
Alpine and the researcher, Özgün Kültekin of Wakefield, give 257 to 1024 bytes, while the CVE record says 256 to 1024 characters. Alpine lists four conditions that must all be true:
- sshd runs without PAM, which is how the Alpine openssh-server package is built, or with UsePAM set to no.
- PasswordAuthentication is yes, which is the OpenSSH default.
- An account has a star as its password field, as root does on Alpine since about release 3.16, as do key-only users.
- At least one other local account has a $5$ or $6$ password hash.
Alpine says systems are not exposed when PasswordAuthentication is no, when openssh-server-pam runs with UsePAM yes, or when an account is locked with an exclamation mark. The researcher says glibc systems, PAM setups, Dropbear and OpenBSD are fine. The researcher names Alpine, OpenWrt, Buildroot and Yocto as musl platforms, so confirm whether your own build uses PAM.
Synology published Synology-SA-26:16 on 6 November 2026 and rates its products Not affected. It lists DSM 7.4 and 7.3, SRM 1.3 and 1.2, APM 2.0 and 1.2, and BeeStation OS 1.5. CISA’s entry in the CVE record lists exploitation as proof of concept, and the flaw is not in the CISA KEV catalogue version 2026.11.04.
Which Versions Fix the Sshole Bug?
Upstream, the record lists OpenSSH before 10.6p2 on Linux as affected. Alpine published fixed packages for every branch back to 3.16, including releases that no longer get regular updates.
| Alpine branch | Fixed openssh package |
|---|---|
| edge | 10.6_p2-r0 |
| 3.24 | 10.3_p1-r2 |
| 3.23 | 10.2_p1-r1 |
| 3.22 | 10.0_p1-r11 |
| 3.21 | 9.9_p2-r1 |
| 3.20 | 9.7_p1-r6 |
| 3.19 | 9.6_p1-r3 |
| 3.18 | 9.3_p2-r4 |
| 3.17 | 9.1_p1-r7 |
| 3.16 | 9.0_p1-r6 |
Alpine says its point releases 3.21.10, 3.22.8, 3.23.8 and 3.24.4 contain the fixed package. Upgrading the package does not restart a running sshd, so restart the daemon afterwards.
What Should You Do Now?
Steps 2 to 5 follow Alpine’s advisory. The first step is our advice.
- List musl hostsFind Linux hosts built on musl, such as Alpine, OpenWrt, Buildroot and Yocto images, and check whether their sshd uses PAM.
- Update and restartInstall OpenSSH 10.6p2 or your distribution’s fixed package from the table, then restart sshd so the running daemon is replaced.
- Close the door if you cannot updateSet PasswordAuthentication to no and restart sshd. Alpine says to confirm key login works in a second session first.
- Review past loginsLook in the system log for sshd lines reading Accepted password for an account that has no password, such as root or a key-only user. Alpine says to treat a machine as compromised if you cannot rule a login out.
- Rebuild old cloud imagesAlpine’s tiny-cloud images from 3.18.11 through 3.24.3 ship an alpine user with passwordless doas, so update running instances.
This is a different flaw from the older regreSSHion race condition in OpenSSH, which OpenSSH says affected non-OpenBSD systems. For the controls behind these steps, see patch management, the valid accounts technique and exploiting public-facing applications.