On this page

OpenSSH password bypass: attacker reaches Alpine honeypot

By Tornike@realtornikeoPublished Nov 6, 2026Last updated Nov 6, 2026

Original sources: Alpine Linux: affected configurations, packages and recovery; OpenSSH: 10.6p2 release notes; Red Hat: CVE assessment; Help Net Security: Previdian founder's honeypot report

Does this apply to me?

Portable OpenSSH sshd on musl LinuxBefore 10.6p2, unless a distributor has backported the fix: PAM disabled and password authentication enabled. An SSH-eligible account has a * password field or is a directory-service user without a local shadow entry; another local account has a $5$ or $6$ hash.Action: OpenSSH 10.6p2 or a distributor package containing the fix
Alpine Linux OpenSSHAlpine 3.16 through 3.24 and edge with an unpatched package: The OpenSSH and account prerequisites above apply.Action: Edge 10.6_p2-r0; 3.24 10.3_p1-r2; 3.23 10.2_p1-r1; 3.22 10.0_p1-r11; 3.21 9.9_p2-r1. See Alpine for older branches.

How severe is it?

High: CVSS 8.1

A reachable attacker can bypass password authentication for an eligible account. The account's privileges determine the impact. Some Alpine cloud configurations allow escalation to root.

Red Hat rates the issue Important with CVSS v3 8.1. My assessment is that exposed administration hosts need prompt patching and investigation.

First reported Nov 5, 2026

CVE-2026-123158

What happened

OpenSSH released a fix on November 5 for a password authentication bypass. On November 6, Previdian's founder told Help Net Security that an attacker gained root access to its Alpine Linux honeypot. The report establishes access to that sensor; it does not establish compromise of a production host.

Alpine's default openssh-server package is built without PAM. Its default root login policy blocks direct root password login. Containers without sshd are outside this exposure.

What to do now

Install the fixed OpenSSH package for your distribution and restart sshd. Alpine says upgrading alone leaves the old daemon running.
If patching must wait, set PasswordAuthentication no and restart sshd. First confirm key access works, keep the current session open and test a new login. Check effective settings for relevant users.
Review SSH logs for password logins to key-only or other passwordless accounts. Check privilege escalation, new users, files and authorized keys. Alpine advises treating a machine as compromised if a login cannot be ruled out.

What this means for your website

SSH often controls deployment and access to website hosts. A bypass can expose site files, secrets and connected systems. Check running hosts and cloud images, including instances whose package version differs from their original image.

Sources and updates

Follow the linked vendor notices for subsequent corrections and updates. The publication and revision dates above track this brief.

Discover vulnerabilities before bad actors do.

AgentDAST tests your live website and returns request evidence your coding agent can investigate. Start with one free health preview and choose a monitoring plan to unlock detailed reports.

Set up your agent →