SSHole OpenSSH Flaw Now Exploited, Root Gained on Honeypot

Attackers are now trying the OpenSSH password bypass we covered yesterday. The flaw has been assigned CVE-2026-123158 (CVSS 8.1) and the codename SSHole. Threat-intelligence firm Previdian told The Hacker News it saw the first exploitation attempt less than nine hours after the CVE was published, and that it confirmed successful root access on a honeypot running Alpine Linux with OpenSSH. Our earlier post on the bug reported that no attacks had been seen at that point.

The bug affects Linux systems running OpenSSH on the musl C library with PAM disabled, which includes Alpine Linux’s default OpenSSH server. When sshd checks a password it can mistake a failed password-hash operation for a match, and an attacker can supply an arbitrary password of 257 to 1,024 bytes to log in as an account that has no usable password. Exploitation needs at least one account with an asterisk (*) as its password hash; accounts with a real hash are not bypassed. The Hacker News says Dropbear, glibc-based Linux distributions, non-Linux systems and systems that check passwords through PAM are not affected.

Previdian’s page lists 8 attempts from 5 unique IP addresses in 5 countries, while The Hacker News quoted the firm describing eight attempts from a single IP address (89.116.89[.]18, geolocated to Japan) that ran id, uname and hostname over non-interactive SSH sessions. We could not reconcile the two descriptions. Previdian’s page also notes the flaw was not in CISA’s Known Exploited Vulnerabilities catalog when we read it. What an attacker gets depends on the account they log in to; Safe Security warns that deployment credentials, application secrets and connected infrastructure could be reachable from a compromised account.

How to check if you’re affected

Affected versions are OpenSSH builds older than 10.6p2 running on Linux with musl libc and without PAM, such as Alpine Linux’s default openssh-server package. Check the installed OpenSSH package version on each Linux host that accepts SSH from the network, and note which distribution it uses (glibc-based distributions and systems using PAM are not affected, per The Hacker News).

• Install OpenSSH 10.6p2 or your distribution’s patched package, then restart sshd. Our earlier post lists the Alpine fix details.
• Alpine recommends searching /var/log/messages for sshd lines reading Accepted password for an account that has no password (such as alpine, root, or any key-only user), then reviewing doas use and recently created users, files and authorized keys on exposed machines.
• The source address Previdian gave The Hacker News for its honeypot hits was 89.116.89[.]18; Previdian’s page counts 5 unique source addresses in total, which we did not review individually.
• OpenSSH’s developer advice from the first disclosure still applies if you cannot patch immediately: set PasswordAuthentication=no or disable SSH on the affected system.

Sources

• Previdian: CVE-2026-123158 Exploitation Attempts Observed — OpenSSH
• Alpine Linux: Security advisory: openssh-server password authentication bypass
• OpenSSH release notes (10.6p2)
• Safe Security: SSHole: High-Severity OpenSSH Vulnerability Turns Disabled Passwords Into Unauthorized Access
• The Hacker News: Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot