How-To: Verify Your OpenSSH Build Is Patched for SSHole

SSHole (CVE-2026-123158) hits musl-based OpenSSH with PAM off—Alpine’s default shape. Here’s a generic check, no hostnames required.

1. On each SSH server: ssh -V and your distro’s package query for openssh. You want 10.6p2 or your vendor’s patched package.
2. Confirm whether PAM is enabled in sshd_config and whether the platform is musl (Alpine and some containers) or glibc.
3. After upgrading, restart sshd (or reboot if that’s your change window).
4. On Alpine-class boxes, search auth logs for “Accepted password for” on accounts that should be key-only or locked (* hash).
5. If you can’t explain a hit, treat the box as compromised: rotate keys, review authorized_keys and new local users.

glibc distros and PAM-on setups are outside the bug’s blast radius—but verifying beats assuming.

God Bless, and Use the Source!

References & Further Reading

• Hackers exploited OpenSSH SSHole within hours (The Hacker News)
• *sshole original (EtherNinja)