OpenSSH / Alpine “sshole” CVE-2026-123158: key-only account password-auth bypass
https://sockanalyst.com/patch-now/openssh-alpine-sshole-cve-2026-123158

Splunk
index=os earliest=-7d (sourcetype=linux_secure OR sourcetype=syslog) "Accepted password for"
| rex field=_raw "Accepted password for (?<ssh_user>\S+) from (?<src_ip>\S+)"
| lookup alpine_musl_hosts.csv host OUTPUT distro openssh_version passwordauthentication usepam
| where isnotnull(distro) AND isnotnull(ssh_user)
| stats count min(_time) as first_seen max(_time) as last_seen values(distro) as distro values(openssh_version) as openssh_version values(passwordauthentication) as PasswordAuthentication values(usepam) as UsePAM by host ssh_user src_ip
| convert ctime(first_seen) ctime(last_seen)
| eval triage="Verify key-only/* account status and doas activity; version/config are inventory, not historical proof"

Sentinel
// Requires the curated AlpineMuslSSHHosts watchlist described in Hunt check.
let HostInventory = _GetWatchlist("AlpineMuslSSHHosts")
| project Computer=tostring(SearchKey), Distro=tostring(distro),
          OpenSSHVersion=tostring(openssh_version),
          PasswordAuthentication=tostring(passwordauthentication), UsePAM=tostring(usepam);
Syslog
| where TimeGenerated >= ago(7d)
| where ProcessName startswith "sshd"
| where SyslogMessage contains "Accepted password for "
| extend SSHUser=extract(@"Accepted password for (\S+) from", 1, SyslogMessage),
         SourceIP=extract(@" from (\S+) port ", 1, SyslogMessage)
| where isnotempty(SSHUser)
| join kind=inner HostInventory on Computer
| summarize Logins=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated)
    by Computer, SSHUser, SourceIP, Distro, OpenSSHVersion, PasswordAuthentication, UsePAM
// Triage against key-only/* account status and doas activity.
// Current inventory does not establish the host's configuration at login time.