OpenSSH vulnerability “sshole”
Our systems running AlmaLinux and Ubuntu are not affected.
On 6 November 2026, the German Federal Office for Information Security (BSI) issued a warning about a vulnerability in OpenSSH. It has the identifier CVE-2026-123158, is known as “sshole” and is rated “high” with a CVSS score of 8.1. Under certain conditions, it allows SSH password authentication to be bypassed: an attacker can log in with an excessively long password without knowing the actual credentials. The OpenSSH project has fixed the flaw in version 10.6p2.
Who is affected
The vulnerability only arises if OpenSSH checks passwords using the musl C library and without PAM (Pluggable Authentication Modules). This combination is found mainly in Alpine Linux.
Our systems
Our servers run AlmaLinux and Ubuntu. Both distributions use the GNU C Library (glibc) and check passwords via PAM. The conditions for the vulnerability are therefore not met – our hosting and cloud systems are not affected. You do not need to take any action.
Recommendation for your own systems
If you operate your own servers or containers, for example based on Alpine Linux, we recommend updating OpenSSH to version 10.6p2 or to the corrected version provided by the vendor. Wherever possible, SSH key authentication should replace password authentication. If you have any questions, our support team will be happy to help.
What can we do for you?
Speak directly to our team in Düsseldorf – by phone, by email or via our contact form.