A newly disclosed OpenSSH vulnerability is already being exploited in the wild — and if your business runs Docker containers, CI/CD pipelines, or lightweight cloud Linux images, there's a real chance you're affected without knowing it.
What happened
On 5 November 2026, Alpine Linux published a security advisory for CVE-2026-123158, nicknamed "SSHole." It's an authentication bypass in the openssh-server package used by Alpine Linux, one of the most common base images for Docker containers because of its small size. The bug lets an attacker log in to accounts that have no password set — such as key-only users — without knowing any password at all, simply by reaching the SSH port.
The technical trigger is specific: the system needs at least one account with no password (password field set to *) alongside one other local account that does have a real password hash. An attacker sends an oversized password — between 257 and 1024 bytes — in a single connection attempt and breaks straight in.
This matters because Alpine images, unlike many full Linux distributions, don't enable PAM (Pluggable Authentication Modules) by default. That missing safety net is exactly what makes the bypass possible. Many businesses use Alpine without realizing this difference, because it's the default base for countless container images pulled straight from public registries.
Why this is urgent, not routine
According to reporting from The Hacker News, threat intelligence firm Previdian observed the first exploitation attempt less than nine hours after the CVE was published. They confirmed attackers achieved full root access on a honeypot running Alpine Linux and OpenSSH. This is not a theoretical flaw waiting to be weaponized — it is already a live, actively exploited attack in the hours after disclosure, meaning any exposed SSH port is a genuine risk right now.
For Swiss SMEs, the exposure often isn't obvious. If you or a developer spun up a quick container for a microservice, a staging environment, a CI/CD runner, or a lightweight VPS using an Alpine-based cloud image, that system could be sitting exposed on the internet with this exact weakness — and nobody checks containers for SSH hardening the way they check a laptop or firewall.
What to do today
- Patch immediately. Update to OpenSSH 10.6p2 or your distribution's patched package, then restart sshd. Don't wait for your next scheduled patch window.
- If you can't patch right away, mitigate now. Disable password authentication entirely (key-based login only), or enable PAM by setting UsePAM yes in your sshd configuration.
- Check your logs today. Search sshd logs for lines reading "Accepted password" tied to an account that should have no password — common examples are alpine, root, or any key-only service account. If you find one, treat that system as compromised and investigate further.
- Inventory your containers and cloud images. List every Alpine-based or musl-based system exposed to the internet, including CI/CD runners, staging servers, and microservices. If IT doesn't know exactly where these are running, that's the first gap to close.
- Restrict SSH exposure generally. Where possible, put SSH access behind a VPN or bastion host rather than leaving the port open to the public internet.
The bigger picture
SSHole is the latest reminder that modern IT infrastructure — containers, cloud images, CI/CD pipelines — moves faster than most businesses can track manually. A flaw like this can go from disclosure to active exploitation in under nine hours, which leaves almost no room for a "we'll look at it next month" approach.
This is exactly the kind of fast-moving risk we track closely, because keeping a few static checklists isn't enough anymore — new vulnerabilities in widely used infrastructure appear on a near-weekly basis, and businesses need someone watching continuously, not just patching twice a year.
If your business relies on containers, cloud servers, or a mix of IT systems and you're not sure whether something like this applies to you, that uncertainty is itself worth addressing. TMC supports Swiss SMEs with practical, hands-on IT support — from checking exposure like this to broader network security and automation — with a free network analysis and a free one-hour consultation to start. We'll keep watching this space and reporting on what matters next.
Switzerland.