OpenSSH SSHole CVE-2026-123158: Unauthenticated Root Bypass on Alpine Linux

CVE-2026-123158, dubbed "SSHole," is a critical unauthenticated password authentication bypass in OpenSSH sshd specifically affecting Alpine Linux due to a flaw in its interaction with musl libc. This vulnerability allows remote attackers to bypass authentication and gain root privileges on locked accounts without valid credentials. Weaponization occurred within nine hours of public disclosure. Given Alpine's widespread adoption as a Docker base image, the vulnerability poses a severe risk to containerized environments, CI/CD pipelines, and cloud-native infrastructure. Remediation requires both updating the OpenSSH package and manually restarting the sshd daemon to eliminate vulnerable resident processes.

• Vulnerability Profile: SSHole (CVE-2026-123158)

  • Affects OpenSSH sshd instances running on Alpine Linux utilizing the musl libc library.
  • Classified as an unauthenticated password authentication bypass with a CVSS score of 8.1.
  • Enables remote attackers to authenticate to locked accounts, leading to immediate root escalation.

• Rapid Exploitation & Threat Landscape

  • Actively exploited in the wild within nine hours of the initial public disclosure.
  • Provides full system compromise, creating high potential for container escapes to the host OS.
  • Facilitates rapid lateral movement across internal cloud networks and orchestration layers.

• Supply Chain & Container Risk

  • Extreme blast radius due to Alpine Linux being a dominant base image for Docker containers.
  • Endangers container registries, automated build pipelines, and downstream derived images.
  • Increases the risk of software supply chain poisoning via compromised build environments.

• Detection & Investigation Vectors

  • Analyze /var/log/auth.log and sshd logs for successful logins to locked or administrative accounts.
  • Monitor for unexpected root session creation and anomalies in source IP authentication.
  • Audit Docker image digests and verify OpenSSH package versions across the container fleet.

• Remediation & Mitigation Requirements

  • Update the OpenSSH package via the Alpine package manager immediately.
  • Critical: Restart the sshd daemon; a package update alone does not remediate the running process.
  • Conduct post-patch audits for indicators of compromise (IoCs) and evidence of lateral movement.