Security & Compliance
November 6, 2026SSHhole: the OpenSSH bypass and your Azure Alpine audit
OpenSSH 10.6p2, released 5 November 2026, closes CVE-2026-123158: on musl-based Linux without PAM, any password of 257 to 1,024 bytes logs in to any account whose shadow field is "*", which is the Alpine default for root and for the user in Alpine's own cloud images. Azure Linux and every endorsed distro are unaffected, so here is the audit for where it actually hides: Alpine VMs from VHDs, App Service custom containers built from Microsoft's SSH template, and sshd pods.
OpenSSH
CVE-2026-123158
Alpine Linux
Security
Azure App Service
AKS
Azure Container Registry
Defender for Cloud
NIS2
Cybersäkerhetslagen
Cyber Resilience Act
By Falak Mahmood