Attackers Exploit Alpine Linux SSH Flaw That Cracks Key-Only Accounts

GreyNoise said on Nov. 6 it was tracking scanning, exploitation attempts and outright successful exploitation of the bug, dubbed SSHole and filed as CVE-2026-123158. Previdian counted 20 attempts from 13 distinct IP addresses across four sensors between Nov. 6 and Nov. 8, though it warns its readings don't prove the targets were vulnerable or that any attempt landed. watchTowr also flagged exploitation on Nov. 6, pointing to botnets and crypto miners doing the hitting.

The attacks trail the Nov. 5 release of OpenSSH 10.6p2, which shipped a workaround for Linux systems running the musl code library with PAM authentication switched off. Alpine's advisory tells operators to install the patched OpenSSH package for their branch and restart sshd, because updating the package alone leaves the running server process untouched. Those who can't patch should set PasswordAuthentication no and restart the service.

The flaw needs a very specific setup: a reachable SSH server with password authentication on and PAM disabled. Alpine's standard openssh-server package is built without PAM, while its PAM-enabled alternative is safe when configured with UsePAM yes. An attacker also needs a login-eligible account storing an asterisk in its password field, plus at least one other account holding a SHA-256 or SHA-512 hash. An oversized password makes musl's hashing function spit back an asterisk as an error marker, which matches the stored field — quietly opening accounts meant for key-only access.

For crypto node, validator and exchange operators on Alpine, Alpine says the thing to check is the host's SSH service and authentication settings, not whether an app happens to sit in an Alpine-based container. Containers that don't run sshd are unaffected.

Alpine also flagged its unpatched tiny-cloud images from 3.18.11 through 3.24.3. They're safe on first boot but turn exploitable once a SHA-512 password hash is added, such as by setting a console password. From there an attacker can log in as the alpine user and climb to root through its passwordless administrative access.

Before killing password authentication, Alpine says to confirm SSH-key login actually works and to keep the current session open while testing a fresh one. On exposed machines, it recommends reviewing logs for accepted password logins to accounts that have no password, along with administrative activity and freshly created users, files and authorized keys. If a login can't be ruled out, Alpine's call is blunt: treat the machine as compromised.