If you manage Alpine Linux bastions or cloud VMs, check what their SSH servers actually accept. A key-only account can still be reachable through a vulnerable daemon when password authentication remains enabled.
Original advisory and fix November 5, 2026. Last verified November 9, 2026. OpenSSH describes its workaround as critical. MITRE’s CVE record rates CVE-2026-123158 High, 8.1 CVSS 3.1. Suggested MSP priority Urgent for exposed SSH services that meet the conditions below.
What changed on November 9
JPCERT/CC reported that GreyNoise observed successful authentication bypass and post-login command execution on its monitored systems beginning November 7. Public proof-of-concept code is also available. JPCERT/CC had no confirmed organizational compromise to report. CISA’s published KEV catalog did not list this CVE at verification, so there is no KEV federal deadline for this entry.
Check applicability
Unpatched Portable OpenSSH sshd before 10.6p2 on Linux is affected when it uses musl libc without PAM and permits password authentication. The attacker must be able to reach SSH. Alpine also identifies two account conditions: an account whose password field is * and another local account with a $5$ or $6$ hash. Check Alpine 3.16 through 3.24 and edge, including openssh-server-pam when UsePAM no is effective. Alpine’s tiny-cloud images from 3.18.11 through 3.24.3 become susceptible if a qualifying hash is added and the other conditions hold. Check vendor guidance before applying this matrix to an appliance or managed image.
Patch and verify
Install OpenSSH 10.6p2 upstream or the fixed package for the installed Alpine branch. Alpine 3.21.10, 3.22.8, 3.23.8 and 3.24.4 include the fix. The table also lists Alpine’s backports to older branches.
| Alpine branch | First fixed openssh package |
|---|---|
| Edge | 10.6_p2-r0 |
| 3.24 | 10.3_p1-r2 |
| 3.23 | 10.2_p1-r1 |
| 3.22 | 10.0_p1-r11 |
| 3.21 | 9.9_p2-r1 |
| 3.20 | 9.7_p1-r6 |
| 3.19 | 9.6_p1-r3 |
| 3.18 | 9.3_p2-r4 |
| 3.17 | 9.1_p1-r7 |
| 3.16 | 9.0_p1-r6 |
1. Inventory. Check customer bastions, VMs and containers that run reachable sshd. Verify the installed package, PAM mode, effective password authentication settings and account conditions. Containers without an SSH daemon are outside this issue.
2. Contain. Restrict SSH to trusted management paths where feasible. If patching must wait, confirm key access, set PasswordAuthentication no including applicable Match blocks, validate with sshd -t and restart. Keep your current session open until a fresh key login works.
3. Roll out and verify. Install the fixed package, restart sshd and verify the running service, installed package and expected login behavior. Upgrading the package alone leaves the old process running.
4. Investigate exposure. Alpine directs administrators to check /var/log/messages for Accepted password for on key-only or passwordless accounts and review doas use, new users, files and authorized keys. Treat a host as compromised if you cannot rule out an unauthorized login.
Official sources
Alpine advisory and fixed packages · OpenSSH release notes · JPCERT/CC exploitation notice · MITRE CVE record · CISA KEV catalog