CVE-2026-123158 (*sshole): OpenSSH Password Authentication Bypass on Alpine Linux

CVE-2026-123158, nicknamed '*sshole', is a critical vulnerability affecting OpenSSH on Alpine Linux that enables password authentication bypass. The flaw is related to Alpine Linux's use of the musl libc library instead of glibc, which affects how OpenSSH handles authentication. The article covers lab results demonstrating the bypass, exposure conditions required for exploitation, and available fixes and mitigations. Alpine Linux is widely used in containerized environments, making this vulnerability particularly relevant to cloud-native and DevOps ecosystems. Users of Alpine-based systems running OpenSSH with password authentication enabled are potentially at risk. The article is published by StepSecurity, a supply chain security-focused firm, suggesting relevance to CI/CD and container security contexts.