OpenSSH Flaw Exploited on Alpine: CISA Adds 4 KEV Bugs
On November 9, CISA added four actively exploited flaws to its KEV catalog. The standout is an OpenSSH bug on Linux systems using musl libc without PAM, such as Alpine Linux, where some setups accept any long password.
⚡ Why it matters
Alpine Linux underpins a huge number of Docker images. If SSH there uses password login, the door may be open. The other bugs hit AI servers, telecom stacks and file transfer.
The four flaws
- OpenSSH (
CVE-2026-123158, CVSS 8.1): sshd before 10.6p2 on Linux with musl libc and no PAM lacks a workaround for a password authentication bypass. In some account configurations, any password between 256 and 1024 characters works. Alpine Linux is one such platform. - GPUStack (
CVE-2026-102895, CVSS 9.8): a GPU cluster manager for serving AI models. Before 2.2.0, it treated requests from 127.0.0.1 as admin, and that source could be spoofed via theX-GPUStack-Real-IPheader, giving unauthenticated admin access, cloud secret exposure and code execution. Exploitation was seen against version 2.1.1. - FreeSWITCH (
CVE-2026-116779, CVSS 9.8): a software telecom stack. Before 1.11.3, any authenticated account could send a crafted SIP MESSAGE that runs API commands, including OS commands, with the daemon's rights. It is exploited in the wild. - IBM Aspera Faspex (
CVE-2026-123218, CVSS 9.8): in 5.0.0 through 5.0.19, an authorized user can craft a message to bypass authorization and gain full admin rights.
What to do
- OpenSSH: upgrade to 10.6p2 or later and rebuild Alpine images. Better yet, set
PasswordAuthentication noand use keys. - GPUStack: upgrade to 2.2.0 and keep it off the internet.
- FreeSWITCH: upgrade to 1.11.3 and review accounts without passwords.
- Aspera Faspex: apply IBM's update beyond 5.0.19.
- Use the KEV catalog to prioritize patching.
🔗 Sources
This article is original reporting by the Security World editorial team based on the sources listed above; direct quotes are kept short and marked with quotation marks. Corrections and feedback: info [at] securitywd.net.
Related stories
FBI Warns Artex AI Tool Automates Hacks at Machine Speed
The FBI issued a flash alert about Artex, an open-source pentesting platform that plugs any LLM into AI agents that run attack stages automatically. Some intrusions reached privileged access in under three hours.
Xen Orchestra Auth Bypass Exploited to Take Over XCP-ng
French vendor Vates warned that a critical flaw in Xen Orchestra, the management tool for XCP-ng virtualization, is under active exploitation. A crafted cookie bypasses authentication, granting admin rights and root control of hosts.
Cisco BroadWorks and Openwave Flaws Exploited, Added to KEV
On Tuesday, November 10, CISA listed two flaws, one in Cisco BroadWorks and one in Openwave Messaging Webtop Media Transcoder, in its Known Exploited Vulnerabilities (KEV) catalog, even though fixes have been out for months.