Attackers exploit OpenSSH password authentication flaw in Alpine Linux

Hackers are actively exploiting a critical OpenSSH vulnerability that allows remote attackers to log into passwordless accounts on Alpine Linux and other musl-based systems, Help Net Security reported. The flaw is tracked as CVE-2026-123158 and nicknamed sshole by Wakefield researcher Özgün Kültekin. Threat intelligence firm Previdian warned that active exploitation of the vulnerability began within nine hours of its public disclosure. [1][2][3][4][5]

According to Help Net Security, an attacker who can reach an exposed SSH port can achieve immediate access without entering a password. The attack requires only a single network connection and succeeds reliably against vulnerable configurations. [1]

OpenSSH is an open-source suite of networking utilities based on the Secure Shell protocol that encrypts network communication to ensure confidentiality and integrity. The software developers fixed the vulnerability in the release of OpenSSH version 10.6p2 on November 5. [1][7]

Security teams operating Alpine Linux or other musl-based distributions should update to OpenSSH version 10.6p2 immediately. Administrators are advised to ensure that remote SSH access is restricted and passwordless accounts are monitored or disabled. [1]