CVE-2026-123158 (“SSHole”) lets any unauthenticated attacker log into locked accounts on Alpine Linux — the base image for the majority of Docker containers. CVSS 8.1. Exploited within nine hours of disclosure. The fix is a package upgrade plus a daemon restart; upgrading alone is not enough.
