Attackers used a new OpenSSH flaw to get root on an Alpine honeypot within hours

OpenSSH published a critical update on November 5, 2026, for a password-login bypass that can affect Linux systems built with the musl C library when PAM is turned off. Alpine Linux, widely used in containers and cloud images, ships its default OpenSSH server that way. The next day, a threat-intelligence firm said attackers had already used the flaw to get root on one of its honeypots.

What was disclosed

Portable OpenSSH 10.6p2, released on November 5, describes “a critical security workaround that affects Linux systems that use the musl libc and PAM disabled.” The project says the release avoids a password authentication bypass that can be reached through sshd in that configuration. It considers the root cause to be outside sshd, but exploitable through it. The bug was reported by Özgün Kültekin of Wakefield.

The flaw is tracked as CVE-2026-123158 and has been nicknamed “sshole.” Help Net Security reported on November 6 that it lets a remote attacker log into accounts that were never supposed to accept a password, on affected musl-based systems. Help Net Security quotes the Alpine Linux team’s advisory as saying an attacker who can reach the SSH port can log in without knowing any password.

The same article says the problem shows up when OpenSSH is built and run without PAM on musl. Alpine’s default openssh-server package is built that way. The researcher also flagged other musl-based systems as worth checking, including some Docker images. Systems that use glibc (Debian, Ubuntu and Fedora among them), setups that check passwords through PAM, Dropbear and OpenBSD were described as unaffected.

Installing a patched package does not, by itself, replace the sshd process that is already running. Help Net Security, citing SOCRadar, reminds administrators that the old binary keeps accepting connections until the service is restarted.

OpenSSH developer Damien Miller urged people running musl-based Linux without PAM to turn off password authentication or disable SSH on those systems immediately, Help Net Security reported.

What researchers saw after the disclosure

On November 6, Previdian founder Ryan Dewhurst told Help Net Security that the firm’s sensors had picked up attacks against the bug, and that at least one attempt succeeded.

“Our first observed attempt arrived less than nine hours after CVE publication, and we’ve confirmed successful root access on a Previdian honeypot running real Alpine Linux and OpenSSH,” he said. The attempts Help Net Security describes came from a single address and were caught by one sensor. The attacker ran basic reconnaissance commands after getting in. Previdian has added the bug to its own exploited-vulnerability list. As of that report, CISA had not added it to the Known Exploited Vulnerabilities catalog.

Proof-of-concept code has been posted publicly. Previdian cautioned that those copies are unverified and could themselves contain malware. There is no reason to download them in order to protect a server.

What this means for you

If you run Debian, Ubuntu, Fedora or another glibc system, or you already send SSH logins through PAM, this particular bypass is not the one described here. If you run Alpine Linux, many official cloud images, or other musl-based appliances and containers, and password authentication is still on, you should assume this update applies until you have patched and restarted sshd.

A honeypot is not the same thing as a wave of broken production servers. What Previdian shows is that someone started trying the new flaw almost immediately, and that the attempt can work.

What you can do

1. If you run a musl-based system with OpenSSH and without PAM, update to OpenSSH 10.6p2 or your distributor’s fixed package, then restart sshd. On Alpine, patched packages were pushed for supported branches the same day as the upstream fix, according to reporting cited by Help Net Security.
2. Until you can patch, turn off password authentication (PasswordAuthentication no) and restart sshd, or take SSH off the public internet. That is the short-term step the OpenSSH developer urged.
3. Look through SSH logs for password logins to accounts that should not have a password, such as a key-only deploy user or the default user on some cloud images. Help Net Security, citing SOCRadar, also suggests reviewing recent administrator-privilege use, new users and authorised-key files. If you cannot rule a login out, treat the machine as compromised.
4. Do not download unverified proof-of-concept exploits to “test” the bug. Previdian warned that some public copies may be malicious.

How Frame helps

This is a flaw in SSH on certain Linux systems, not a published list of customer emails. The checks above are the useful part. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame never collects or stores the leaked records themselves.

Sources

• OpenSSH, Portable OpenSSH 10.6p2 release notes, November 5, 2026
• Help Net Security, OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158), November 6, 2026