The flaw, CVE-2026-123158, affects Linux distributions built on the musl libc that run without PAM, such as Alpine, Buildroot, OpenWrt and Yocto. Under certain conditions, the SSH server accepts an overly long password as correct, even for accounts that should never accept a password, such as root. On Alpine, affected accounts include root, users created without a password and the alpine user in the official cloud images.
OpenSSH released a fix last week, and Alpine urged users to install it and restart sshd. Over the weekend, WatchTowr and Previdian reported exploitation in the wild; according to WatchTowr, only botnets and crypto miners have used it so far. Previdian observed 20 exploitation attempts from 13 IP addresses in 9 countries between November 6 and 8, and GreyNoise and Defused also reported attempts.
What to do: update to OpenSSH 10.6p2 as soon as possible. If updating right away is not possible, disable password authentication (on by default) or disable SSH, and check logs for unusual login requests.