What happened. CVE-2026-123158 (CVSS 8.1), nicknamed sshole / *sshole by researcher Özgün Kültekin, hits OpenSSH before 10.6p2 on musl Linux with PAM disabled — Alpine's default openssh-server package, plus OpenWrt, Buildroot, Yocto and many Docker images. An oversized password (257–1024 bytes) can authenticate to accounts whose password field is * (password-disabled / key-only). It does not bypass real password hashes, and it does not affect glibc builds, PAM-enabled sshd, Dropbear or OpenBSD.
Already exploited. OpenSSH shipped the fix in 10.6p2 on Nov 5; Alpine patched all branches 3.16 through edge the same day. You must restart sshd after the upgrade. On Nov 6, Previdian reported the first attempt under 9 hours after the CVE went public, confirmed successful root on an Alpine/OpenSSH honeypot, and logged 8 attempts from Japan IP 89.116.89.18 running id, uname and hostname. Not yet on CISA KEV as of Help Net Security Nov 6. Alpine AWS/Azure tiny-cloud images ship a default alpine user with passwordless doas — an effective root path if sshole lands.
What to do. Upgrade to OpenSSH 10.6p2 (or your distro's patched package) and restart sshd. If you cannot patch yet, set PasswordAuthentication no and restart sshd. Inventory Alpine and musl-based containers and appliances that expose SSH.