Customer Security Advisory: OpenSSH Password Authentication Bypass Vulnerability [CVE-2026-123158]

Akamai is aware of the <a href="https://sshhole.com">password authentication bypass vulnerability</a> affecting certain Linux systems using <a href="https://www.openwall.com/lists/musl/2026/11/05/4">musl libc</a> that was recently mitigated by an <a href="https://openssh.com/releasenotes.html#10.6p2">urgent OpenSSH update</a>. Since Alpine Linux is specifically called out as being affected, we wanted to assure customers that Linode’s Alpine images are not affected by this vulnerability. Linodes using password-less provisioning do not have password authentication enabled by default unless customers change this configuration option in sshd_config after launch, while linodes launched using a password do not have any unlocked user accounts with a password hash set to ‘*’.

However, we would like to use this opportunity as a reminder for customers to consider disabling password authentication permanently in favor of more secure mechanisms such as SSH keys or SSH CA certificates.