Linux SSH Flaw Allows Passwordless Login: CVE-2026-123158 Explained 2026

A critical Linux SSH vulnerability, tracked as CVE-2026-123158, allows remote attackers to log into certain accounts without a valid password. Dubbed sshole, the flaw was discovered by researcher Özgün Kültekin and affects specific configurations of Alpine Linux that combine OpenSSH with musl and lack PAM. Patches were released on November 5 by both OpenSSH and Alpine.

The vulnerability is particularly dangerous because it turns a security measure—disabling password authentication for certain accounts—into a backdoor. Accounts that should only accept key-based or other authentication methods can be accessed with any password, or none at all, under certain conditions.

What Is CVE-2026-123158 and Why It Matters

CVE-2026-123158 is a logic flaw in how OpenSSH interacts with musl, a lightweight C library used by Alpine Linux. When PAM (Pluggable Authentication Modules) is absent, the authentication process can be bypassed entirely for accounts configured to disallow password logins. This means an attacker can gain unauthorized access without knowing the password.

The flaw has existed for nearly a decade, according to the researcher, making it a long-standing hidden risk. Systems that use glibc and PAM are not affected by this specific issue, but other platforms with similar configurations might be vulnerable.

How the Vulnerability Works

In a typical Linux setup, PAM handles authentication and enforces policies like password complexity and account lockouts. When PAM is missing, OpenSSH falls back to its own authentication mechanisms. In Alpine Linux with musl, this fallback incorrectly treats certain accounts as having no password, effectively granting access.

The problem arises when an account is locked or has password authentication disabled. Instead of rejecting the login attempt, the system may allow it, bypassing the intended restriction. This is a classic case of a security control failing in an unexpected way.

Which Systems Are Affected?

According to the report, the vulnerability has been confirmed in Alpine Linux configurations that use OpenSSH with musl and do not use PAM. Other Linux distributions that meet these conditions could also be at risk. Systems using glibc and PAM are not affected by this specific flaw. Context on how this played out before sits in Linux SSH Flaw Allows Passwordless Login: CVE-2026-123158 Explained.

Alpine Linux is popular in containerized environments and lightweight servers, so the impact could be significant in cloud-native infrastructures. Administrators should check their configurations urgently. The background to this story is set out in X Account Scam Alert: How Fraudsters Target Your Login. A related thread runs through X Account Phishing Scam: How to Spot Fake Login Alerts.

Key Takeaways for System Administrators

• Patch immediately: Apply the updates released by OpenSSH and Alpine on November 5.
• Audit configurations: Check if your systems use OpenSSH with musl and lack PAM.
• Review account policies: Ensure accounts with password authentication disabled are truly protected.
• Monitor for unusual logins: Look for unauthorized access attempts, especially on Alpine-based systems.
• Consider PAM: If feasible, enable PAM for centralized authentication management.

Comparison of Affected and Unaffected Configurations

What to Do Next

If you manage Alpine Linux systems, update OpenSSH and Alpine packages immediately. Verify that your authentication logs do not show suspicious successful logins for accounts that should not have password access. Consider enabling PAM if your environment supports it, as it provides a more robust authentication framework. Earlier coverage in X Account Scam Alert: New Device Login Email Targets Users shows how the argument developed. A closer look at the same subject appears in Technology: latest articles.

For those running containers based on Alpine, rebuild images with the patched packages. The flaw's decade-long presence means that any unpatched system could have been exploited silently, so a thorough review of access logs is prudent. Anyone following the wider picture can start with Critical macOS Flaw Allows Passwordless Access and Is Actively Exploited. The same theme surfaces in Passkeys Security Flaw: New Research Exposes Passwordless Risk, which takes a different angle.

FAQ

Understanding how authentication mechanisms interact is crucial for maintaining secure systems. For a broader perspective on managing security and compliance in business environments, see our article on cotizar sin trabajar: cómo funciona el convenio especial con la Seguridad, which discusses long-term planning and risk management.