Attackers Exploit Alpine SSH Password-Bypass Flaw

Attackers are exploiting the SSH password-bypass flaw affecting some Alpine Linux systems, with GreyNoise reporting successful exploitation and other security firms detecting attack activity.

GreyNoise said on Nov. 6 it was monitoring “scanning, exploitation attempts, and successful exploitation” of the vulnerability, known as SSHole and tracked as CVE-2026-123158.

Separately, Previdian reports 20 exploitation attempts from 13 distinct IP addresses across four sensors, with activity dated Nov. 6–8. The company cautions that its sensor observations do not establish whether the targets were vulnerable or whether the attempts succeeded.

watchTowr also reported exploitation on Nov. 6, saying the activity involved “botnets and crypto miners.”

The attacks follow the Nov. 5 release of OpenSSH 10.6p2, which introduced a workaround for Linux systems using the musl code library with PAM authentication disabled. The Defiant covered the flaw when the fix was released.

Alpine’s advisory tells operators to install the patched OpenSSH package for their Alpine branch and restart the SSH server, sshd. Updating the package alone leaves the running server process unchanged. Operators unable to patch should set PasswordAuthentication no and restart the service instead.

Key-Only Accounts Can Still Be Exposed

Exploitation requires a reachable SSH server with password authentication enabled and PAM, an authentication framework, disabled. Alpine’s standard openssh-server package is built without PAM. Its PAM-enabled alternative is unaffected when configured with UsePAM yes.

The machine must also have a login-eligible account whose stored password field is an asterisk, plus at least one other account with a SHA-256 or SHA-512 password hash. That combination can expose accounts intended for key-only access: an oversized password makes musl’s hashing function return an asterisk as an error marker, which then matches the account’s stored field.

For crypto node, validator and exchange operators running Alpine, the relevant check is the host’s SSH service and authentication settings—not simply whether an application uses an Alpine-based container. Alpine says containers that do not run sshd are unaffected.

Alpine also warns that its unpatched tiny-cloud images from 3.18.11 through 3.24.3 are safe on first boot but become exploitable if a SHA-512 password hash is added, such as by setting a console password. An attacker can then enter as the alpine user and gain root privileges through its passwordless administrative access.

Before disabling password authentication, Alpine advises checking that SSH-key login works and keeping the existing session open while testing a new login.

For exposed machines, the advisory recommends reviewing logs for accepted password logins to accounts that have no password, along with administrative activity and newly created users, files and authorized keys. If a login cannot be ruled out, Alpine says to treat the machine as compromised.