+91 80401 38000sales@servergurus.com24/7 Expert Support
support@servergurus.comClient Portal →
ServerGurus
← All posts
SecurityCVEHostingInfrastructure

CVE-2026-123158: SSHole Hits CISA KEV - Alpine sshd, Not Your cPanel Box

By ServerGurus Team10 November 202611 min read
CVE-2026-123158: SSHole Hits CISA KEV - Alpine sshd, Not Your cPanel Box

CVE-2026-123158 is the MITRE name for a password authentication bypass in sshd on Linux when musl libc is used without PAM. CVE text: for some account configurations, any password between 256 and 1024 characters succeeds. Example platform named in the record: Alpine Linux. Upstream portable floor is OpenSSH 10.6p2, released 2026-11-05. OpenSSH’s own notes call it a critical security workaround and say the root cause is outside sshd, but it is exploitable via sshd.[1][2][3]

CISA added it to KEV on 2026-11-09. Name in the catalog: OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability. CWE CWE-394. Due 2026-11-12. knownRansomwareCampaignUse Unknown. forensicTriage Yes. Catalog we pulled this morning: 1,773 entries, dateReleased 2026-11-09T19:54:37.4945Z. That add landed after yesterday’s 09:00 IST post (catalog then 1,769).[4]

MITRE CVSS 3.1 8.1 HIGH AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Ubuntu copies 8.1 and sets priority high with the note “Is in CISA KEV list.” NVD Primary was not yet provided on the NVD HTML we hit (403 this morning); we are not inventing an NVD score. Red Hat’s product statement is not affected (glibc + PAM). Red Hat still published their own vector 9.8 AV:N/AC:L/... on the same page - that is their score for the class of bug, not a claim that RHEL sshd is exploitable.[1][5][6]

Nickname sshole / *sshhole is from the researcher write-up and the oss-security subject, not from CISA. Reporter: Özgün Kültekin (Wakefield). Fix: Damien Miller / Darren Tucker, commit 4353fdc43ef646c43a8dda7025cc1a898caf1482.[2][3][7]

This is not your cPanel / CloudLinux / Alma / Ubuntu sshd. Those link OpenSSH against glibc and run PAM. If you only run those, stop after the “Who is affected” table and go back to yesterday’s CloudLinux kernel post. If you run Alpine (or any musl + UsePAM no sshd) with port 22 on the internet - k8s node images, GPU jump boxes, tiny-cloud VMs, CI runners - this is the KEV due 12 Nov.

What it is

Without PAM, sshd checks a password by hashing the attempt with libc crypt() and comparing the result to the account’s stored field. Alpine’s default openssh-server is built without PAM.[7][3]

Two values collide:

  • Accounts with no password (key-only users, Alpine root:* since ~3.16, the alpine user on official tiny-cloud images) store exactly * in the password field.
  • musl crypt() returns the string * as an error when the key is over 256 bytes.

For a stored field too short to hold a salt, sshd borrows the salt of another account. If that other account has a $5$ or $6$ hash, the long-password error string matches *, and sshd treats the login as success. Alpine: one local user with a real hash makes every * account reachable. One connection. No retries. They name 257-1024 bytes as the window. The CVE text says 256-1024.[1][7]

OpenSSH 10.6p2 does not “fix musl.” It avoids the comparison in sshd (they check a minimum hash length instead of trusting musl’s *). Stable-branch Alpine packages carry that workaround on older OpenSSH versions; you do not need 10.6p2 on 3.22 if you have their patched NVR.[2][7]

We did not send a long password at anyone’s sshd. Treat “works every time” as Alpine’s wording, not a test we ran.

How serious is it?

On paper: network, no privileges, high C/I/A, attack complexity High on the MITRE vector (conditions: musl, no PAM, password auth on, a * account, a $5$/$6$ hash somewhere). That is still unauth remote login on a box that meets those conditions.[1][6]

On Alpine’s wording (5 Nov, before KEV): an attacker who can reach the SSH port logs in without knowing a password. Default PermitRootLogin prohibit-password protects root itself. It does not help if another account can doas to root. Official tiny-cloud images (qcow2 / VHD / AMI, 3.18.11 through 3.24.3) ship alpine with * and passwordless doas. Safe on first boot. Exploitable as soon as any $6$ hash exists (console password, hashed_passwd in user-data). Then: shell as alpine, doas to root.[7]

KEV: CISA listed it 9 Nov with a 12 Nov due date and forensic triage Yes. That is CISA’s evidence-of-exploitation bar. We did not independently confirm GreyNoise / WatchTowr / press counts; those are not in the KEV JSON. Do not upgrade a blog’s “16 successful chains” into a CISA number.[4]

Not ransomware-tagged. Catalog field is Unknown.[4]

Who is affected

In scope only if all of Alpine’s conditions hold (their 5 Nov advisory):[7]

  1. Alpine openssh-server (no PAM), or openssh-server-pam with UsePAM no. UsePAM yes is not this bug.
  2. PasswordAuthentication yes (OpenSSH default unless you changed it).
  3. An account whose password field is *.
  4. At least one local account with a $5$ or $6$ hash.
Distro / product This bug? Floor / note
Alpine edge Yes, default sshd openssh 10.6_p2-r0. Then restart sshd.[7][8]
Alpine 3.24 Yes 10.3_p1-r2 (in 3.24.4).[7][9]
Alpine 3.23 Yes 10.2_p1-r1 (in 3.23.8).[7][9]
Alpine 3.22 Yes 10.0_p1-r11 (in 3.22.8).[7][9]
Alpine 3.21 Yes; 3.21 EOS 2026-11-01 9.9_p2-r1 (in 3.21.10). Alpine still shipped the package.[7][9]
Alpine 3.20 → 3.16 Yes; unsupported 3.20 9.7_p1-r6; 3.19 9.6_p1-r3; 3.18 9.3_p2-r4; 3.17 9.1_p1-r7; 3.16 9.0_p1-r6. Alpine published them anyway.[7]
tiny-cloud images 3.18.11-3.24.3 Become exploitable once a $6$ hash exists Rebuild from 3.21.10 / 3.22.8 / 3.23.8 / 3.24.4+, or patch the running instance.[7]
RHEL / all Red Hat product builds Not affected glibc + PAM. Bugzilla 2567690. Statement pulled 10 Nov 2026, 02:00:14 UTC last-modified.[5]
CloudLinux / Alma / Rocky / cPanel sshd Treat as not this path Same glibc+PAM stack as RHEL. Do not upcp for this ID.
Ubuntu openssh Tracker needs-triage on every release we fetched mdeslaur: default is not musl, “should be not-affected… but musl is available in the archive.” Priority high because KEV. No USN in notices_ids. JSON updated_at 2026-11-09T17:50:03Z.[6]
Debian bookworm / trixie openssh Tracker still vulnerable on the installed NVRs Urgency unimportant. Fixed in forky/sid 1:10.6p2-1. glibc+PAM; they have not backported.[10]
Containers that do not run sshd Not affected Alpine’s own “who is not.”[7]
PasswordAuthentication no Not affected Alpine and OpenSSH both name this as the workaround.[2][7]
Locked user:!: shadow Not this login Alpine: cannot password or key.[7]

OpenWrt / Buildroot / Yocto appear in press summaries of the researcher post. We did not pull those vendors’ advisories this morning. If you run musl sshd without PAM there, apply the same four-condition check; do not take a host-blog product list as a CNA CPE.

What to do now

  1. Decide if the box is musl + no PAM. A cPanel WHM host is the wrong queue.
# libc sshd is actually using:
ldd "$(command -v sshd)" | grep -E 'musl|libc.so'
sshd -T 2>/dev/null | grep -Ei 'usepam|passwordauthentication|permitrootlogin'
apk version openssh 2>/dev/null

musl in ldd and usepam no and passwordauthentication yes → keep going. glibc + PAM → you are not this CVE. Ubuntu with a separate musl-linked sshd binary is the exception their note flags; we have not seen that as a default.

  1. Alpine: upgrade, then restart. Package install does not replace the running daemon. Alpine is explicit.[7][9]
apk upgrade -U -a
apk info -v openssh
rc-service sshd restart
# want, by branch:
# edge     10.6_p2-r0
# 3.24     10.3_p1-r2
# 3.23     10.2_p1-r1
# 3.22     10.0_p1-r11
# 3.21     9.9_p2-r1
  1. If you cannot upgrade today - Alpine’s documented workaround. Test a key login in a second session first.[7]
mkdir -p /etc/ssh/sshd_config.d
echo 'PasswordAuthentication no' > /etc/ssh/sshd_config.d/00-no-passwords.conf
sshd -t && rc-service sshd restart
sshd -T | grep -i passwordauthentication
# expect: passwordauthentication no

Older than 3.19: drop-ins are ignored; you must edit /etc/ssh/sshd_config. Alpine published a sed for that; keep a session open.[7]

  1. Inventory Alpine, not just VMs. docker ps / k8s pods that run sshd (bastion sidecars, GitLab runners that expose 22, GPU boxes with an Alpine userspace). A PHP-FPM Alpine container with no sshd is out.

  2. Rebuild images. Pin to 3.24.4 / 3.23.8 / 3.22.8 / 3.21.10 or later. Do not bake 3.24.3 and call it patched.

  3. Until sshd is the new binary: do not expose 22/tcp to the world on musl hosts. That is operational hygiene, not a substitute for the package.

We are not publishing password strings or a login one-liner.

Versions with no floor

  • Alpine 3.15 and older: Alpine’s table we pulled stops at 3.16. Treat as unpatched unless you prove a backported package.
  • Any musl sshd you compiled yourself without the 10.6p2 workaround: you are on the hook.
  • Ubuntu/Debian glibc sshd: no floor required for this ID on the default stack. Recheck if you installed musl and a custom sshd.
  • openssh-ssh1 on Ubuntu: ignored / “insecure, trusted environments only.” Irrelevant to this musl path.[6]

Compromise signs

None of these prove CVE-2026-123158. Alpine’s hunt list:[7]

  • /var/log/messages (or your syslog) Accepted password for an account that has no password: alpine, root, any key-only user.
  • New authorized_keys, new users, unexpected doas use on tiny-cloud images.
  • sshd still the pre-floor package and 22/tcp reachable and a $5$/$6$ hash on the box.

If you cannot rule out a password login to a * account after 5 Nov, treat the machine as compromised (Alpine’s words). Snapshot, rotate keys, do not “just apt upgrade and hope.”

CISA forensic triage is Yes for FCEB; everyone else: that is a hint to look, not a BOD that binds a Hyderabad VPS.

FAQ

Is my cPanel server on KEV for this? No. KEV names OpenSSH. The exploitable configuration in the CVE and Alpine advisory is musl without PAM. Red Hat: products not affected. cPanel sshd is the RHEL/CloudLinux build.[4][5][1]

Do I need OpenSSH 10.6p2 on Alpine 3.22? No. You need 10.0_p1-r11 (or later on that branch). edge is the line that ships 10.6_p2-r0.[7][8]

Does apk upgrade finish the job? No. Restart sshd.[7]

Is root reachable? Only if PermitRootLogin yes, or you can log in as another * account that can doas/sudo. Default Alpine prohibit-password blocks password root. tiny-cloud alpine + passwordless doas is the documented root path.[7]

Same as yesterday’s CloudLinux UDP UAF? No. CVE-2026-98276 is local kernel. This is remote sshd on a different libc.

Is it on KEV? Yes. Added 2026-11-09, due 2026-11-12. Catalog 1,773 this morning.[4]

Honesty

  • We did not exploit this. No long-password login was sent.
  • CVSS 8.1 is MITRE / Ubuntu copy AV:N/AC:H/.... Red Hat product score 9.8 sits on a not affected statement - do not flatten that into “RHEL is 9.8.” NVD Primary not cited (page 403 from this box).[1][5][6]
  • “Works every time / one connection” is Alpine 5 Nov. CISA did not repeat those words in the KEV shortDescription.[4][7]
  • In-the-wild counts from GreyNoise, WatchTowr, Previdian, Bleeping Computer are not in the KEV JSON we saved. KEV membership is the exploitation claim we will stand on.
  • Ubuntu openssh is still needs-triage as of updated_at 2026-11-09T17:50:03Z. Their own note says default should be not-affected.
  • Debian urgency unimportant; bookworm/trixie rows still vulnerable on the tracker. That is “we are not rushing a glibc backport,” not “Debian sshd is Alpine.”
  • OpenWrt/Buildroot/Yocto: not verified against vendor pages this morning.
  • Researcher GitHub labs exist; we are not centering them and we are not linking a PoC as the fix.
  • KEV count 1,773 / dateReleased 2026-11-09T19:54:37.4945Z from the JSON saved 10 Nov 2026 morning IST.

Sources

  1. CVE Record / NVD CVE-2026-123158 - musl without PAM; 256-1024 character password; Alpine named; MITRE 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H; KEV row on the NVD page
  2. OpenSSH 10.6p2 release notes - 2026-11-05; “critical security workaround”; PAM disabled; root cause outside sshd; reporter Özgün Kültekin
  3. oss-security, 5 Nov 2026 - Jan Schaumann; subject “sshole”; crypt(3) returns *
  4. CISA KEV JSON - CVE-2026-123158 added 2026-11-09; due 2026-11-12; CWE-394; forensicTriage Yes; notes point at OpenSSH releasenotes, Alpine 2026-11-05 post, commit 4353fdc4; catalog 1,773 / dateReleased 2026-11-09T19:54:37.4945Z
  5. Red Hat CVE-2026-123158 - products not affected; glibc + PAM; Bugzilla 2567690; CWE-303; last modified 2026-11-10 02:00:14 UTC
  6. Ubuntu CVE-2026-123158 JSON - priority high (KEV); cvss 8.1; openssh needs-triage; mdeslaur musl-not-default note; updated_at 2026-11-09T17:50:03Z
  7. Alpine advisory, 2026-11-05 - conditions, floors, tiny-cloud doas path, restart requirement, Accepted password for hunt
  8. Alpine security tracker CVE-2026-123158 - edge 10.6_p2-r0 fixed; 3.24 10.3_p1-r2; 3.23 10.2_p1-r1; 3.22 10.0_p1-r11; 3.21 9.9_p2-r1
  9. Alpine 3.21.10 / 3.22.8 / 3.23.8 / 3.24.4 - 2026-11-05 point releases
  10. Debian tracker CVE-2026-123158 - bookworm/trixie vulnerable; sid 1:10.6p2-1; urgency unimportant
  11. OpenSSH portable commit 4353fdc4

Ready to build your infrastructure?

Get a quote from our Hyderabad-based team - Tier IV datacenter, real support, INR or USD billing.

View pricingRequest a quoteWhatsApp sales