Blog

The security vulnerability CVE-2026-123158 (“sshole”) affects the OpenSSH server (sshd) on Alpine Linux and allows password authentication to be bypassed.

ReportServer itself is not affected by this vulnerability. The issue is located in the operating system's OpenSSH service, not in ReportServer or its Java libraries. ReportServer's integrated SFTP server does not use OpenSSH either.

The official ReportServer Docker container is also not affected, as it is not based on Alpine Linux and does not include openssh-server.

Recommendations for Administrators

For custom deployments, we recommend checking the following:

1. Is the system running Alpine Linux?
   cat /etc/os-release
2. Is an OpenSSH server installed and accessible?
   apk info -v openssh-server

If both conditions apply, update OpenSSH to the latest available version.

As a temporary mitigation, password authentication can be disabled by setting PasswordAuthentication no in sshd_config. Make sure SSH key-based authentication is working before applying this change.

If you have any further questions, please feel free to contact our team (info@infofabrik.de).