OpenSSH flaw lets attackers access password-disabled accounts on some Linux systems
Summary
A critical vulnerability, dubbed *SSHole and tracked as CVE-2026-123158, affects OpenSSH servers on Linux systems using the musl C library, allowing remote attackers to bypass authentication and access password-disabled accounts. The flaw, which has existed for 10 years, is particularly impactful on Alpine Linux due to its common use in cloud Docker containers and embedded systems.
IFF Assessment
This vulnerability allows remote attackers to bypass authentication and gain access to accounts, which is bad news for defenders.
Severity
Defender Context
Defenders should prioritize patching OpenSSH on Linux systems using the musl C library, especially those running Alpine Linux or in containerized environments. Organizations need to verify their OpenSSH configurations to ensure PAM is enabled and password authentication is properly managed to mitigate this risk.