A critical unauthenticated remote code execution vulnerability, CVE-2026-123158, was disclosed in OpenSSH last week and confirmed exploited in under 9 hours. The flaw targets Alpine Linux containers running OpenSSH with musl libc and PAM authentication disabled, a stack that covers millions of container workloads. The bug earned the name SSHole from the original researcher.
What the vulnerability does
CVE-2026-123158 is a double-free in the sshd privilege-separation sandbox under musl libc. When PAM is disabled, as it is by default in Alpine Linux, the memory allocator behaves differently from glibc. An attacker who sends a specially crafted authentication sequence before any credentials are checked can corrupt the heap and gain code execution as root with no prior access required. CVSS base score is 8.1.
Who is exposed
Any sshd running OpenSSH 8.9p1 through 10.6p1 compiled against musl libc with PAM disabled is vulnerable. Alpine Linux Docker images are the most common affected environment. Ubuntu and Debian hosts use glibc and PAM by default and are not affected by this code path. Cloud providers' managed container services using Alpine base images are in scope.
Exploitation timeline
Disclosure occurred at 10:14 UTC on 5 November 2026. A functional proof-of-concept was posted to a private bug-bounty channel at 19:02 UTC, under 9 hours later. CISA added CVE-2026-123158 to the Known Exploited Vulnerabilities catalog at 23:40 UTC with a 20 November 2026 FCEB remediation deadline. Threat actor scanning activity was first observed at 21:15 UTC.
Root cause lineage
The underlying allocator divergence between musl and glibc traces to CVE-2016-6210, a timing oracle bug patched in 2016. That fix introduced a code path that behaves safely with glibc but leaves a small window for heap manipulation under musl. Ten years of container adoption expanded the attack surface from a niche configuration to a mainstream deployment target.
What to do now
Upgrade to OpenSSH 10.6p2, released 5 November 2026, which eliminates the double-free. For Alpine-based containers, update the base image and rebuild. If immediate upgrade is not possible, temporarily enable PAM (UsePAM yes in sshd_config) or restrict sshd to key-based authentication only via AllowUsers and AuthorizedKeysFile. Review /var/log/messages for lines matching Accepted password for from unexpected source IPs as an indicator of compromise.
Written by Gigia Tsiklauri, founder of Infosec.ge.