Source: https://agentdast.com/newsletter/openssh-musl-password-bypass-cve-2026-123158

# OpenSSH password bypass: attacker reaches Alpine honeypot

[By Tornike (@realtornikeo)](https://x.com/realtornikeo)

 Published Nov 6, 2026  Last updated Nov 6, 2026 

Original sources: [Alpine Linux: affected configurations, packages and recovery](https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/); [OpenSSH: 10.6p2 release notes](https://www.openssh.org/releasenotes.html#10.6p2); [Red Hat: CVE assessment](https://access.redhat.com/security/cve/cve-2026-123158); [Help Net Security: Previdian founder's honeypot report](https://www.helpnetsecurity.com/2026/11/06/openssh-sshole-cve-2026-123158-exploitation/)

## Does this apply to me?

**Portable OpenSSH sshd on musl Linux** Before 10.6p2, unless a distributor has backported the fix 

PAM disabled and password authentication enabled. An SSH-eligible account has a \* password field or is a directory-service user without a local shadow entry; another local account has a $5$ or $6$ hash.

Action: OpenSSH 10.6p2 or a distributor package containing the fix

**Alpine Linux OpenSSH** Alpine 3.16 through 3.24 and edge with an unpatched package 

The OpenSSH and account prerequisites above apply.

Action: Edge 10.6\_p2-r0; 3.24 10.3\_p1-r2; 3.23 10.2\_p1-r1; 3.22 10.0\_p1-r11; 3.21 9.9\_p2-r1. See Alpine for older branches.

## How severe is it?

**High: CVSS 8.1**

A reachable attacker can bypass password authentication for an eligible account. The account's privileges determine the impact. Some Alpine cloud configurations allow escalation to root.

Red Hat rates the issue Important with CVSS v3 8.1. My assessment is that exposed administration hosts need prompt patching and investigation.

First reported Nov 5, 2026

`CVE-2026-123158`

## What happened

OpenSSH released a fix on November 5 for a password authentication bypass. On November 6, Previdian's founder told Help Net Security that an attacker gained root access to its Alpine Linux honeypot. The report establishes access to that sensor; it does not establish compromise of a production host.

Alpine's default openssh-server package is built without PAM. Its default root login policy blocks direct root password login. Containers without sshd are outside this exposure.

## What to do now

1.  Install the fixed OpenSSH package for your distribution and restart sshd. Alpine says upgrading alone leaves the old daemon running.
2.  If patching must wait, set PasswordAuthentication no and restart sshd. First confirm key access works, keep the current session open and test a new login. Check effective settings for relevant users.
3.  Review SSH logs for password logins to key-only or other passwordless accounts. Check privilege escalation, new users, files and authorized keys. Alpine advises treating a machine as compromised if a login cannot be ruled out.

## What this means for your website

SSH often controls deployment and access to website hosts. A bypass can expose site files, secrets and connected systems. Check running hosts and cloud images, including instances whose package version differs from their original image.

## Sources and updates

-   [Alpine Linux: affected configurations, packages and recovery ↗](https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/)
-   [OpenSSH: 10.6p2 release notes ↗](https://www.openssh.org/releasenotes.html#10.6p2)
-   [Red Hat: CVE assessment ↗](https://access.redhat.com/security/cve/cve-2026-123158)
-   [Help Net Security: Previdian founder's honeypot report ↗](https://www.helpnetsecurity.com/2026/11/06/openssh-sshole-cve-2026-123158-exploitation/)

Follow the linked vendor notices for subsequent corrections and updates. The publication and revision dates above track this brief.

### Discover vulnerabilities before bad actors do.

AgentDAST tests your live website and returns request evidence your coding agent can investigate. Start with one free health preview and choose a monitoring plan to unlock detailed reports.

[Set up your agent →](https://agentdast.com/agents)

## Keep reading

-   [WordPress wp2shell: update core and check for compromise](https://agentdast.com/newsletter/wordpress-wp2shell-cve-2026-60137-cve-2026-63030)
-   [eMudhra CA keys compromised: update trust stores and check certificate chains](https://agentdast.com/newsletter/emudhra-certificate-authority-key-compromise)