OpenSSH CVE-2026-123158 Exploited in the Wild on Alpine Linux, CISA Adds the Password Bypass to KEV

The OpenSSH password bypass on musl-based Linux now has an identifier, CVE-2026-123158, and attackers are using it. CISA added it to the Known Exploited Vulnerabilities catalogue on 9 November, and gave US federal agencies until 12 November. The flaw lets anyone who reaches the SSH port log in to an account that has no password by sending "any password between 256 and 1024 characters".

Alpine's advisory went out before any CVE existed, and the earlier report covers which Alpine servers are exposed and how musl's crypt() causes the bypass.

Attacks on honeypots

Threat intelligence firm Previdian told Help Net Security that its own sensors caught a first attempt "less than nine hours after CVE publication", and that the attacker got root on one of its Alpine honeypots and ran reconnaissance commands such as id and uname.

The CVE record scores the flaw 8.1, high, and carries CISA's rating of exploitation as "active".

GreyNoise saw its first successful exploitation at 00:46 UTC on 7 November and has since logged 17 successful exploitation chains from six attacker IPs. On some of its sensors the intruders wrote to authorized_keys under both the alpine and root accounts and tried to read /etc/shadow.

Who is exposed

The flaw needs sshd built with musl libc and without PAM. Red Hat says its builds "link OpenSSH against the GNU C Library (glibc) and use PAM by default" and aren't affected, and BleepingComputer lists OpenWrt, Buildroot and Yocto among the musl-based systems to check alongside Alpine.

Fixed versions and clean-up

Upstream, Portable OpenSSH 10.6p2 blocks the bypass. Alpine's fixed openssh builds run from 10.6_p2-r0 on edge and 10.3_p1-r2 on 3.24 down to 9.0_p1-r6 on 3.16; sshd must be restarted after the upgrade. A server that can't be patched should set PasswordAuthentication no.

Patching doesn't remove a key an intruder planted. Alpine's advice is that a server whose logs show an "Accepted password for" line naming an account with no password should be treated as compromised.