Hackers exploit OpenSSH *SSHole flaw to reach privileged Linux accounts

Researchers say hackers are actively exploiting CVE-2026-123158, nicknamed sshole, to reach privileged accounts on Linux systems after the flaw became public last Thursday.

The vulnerability comes from how OpenSSH works with the musl code library. On affected systems, the sshd process pulls salt from a different account while validating a passwordless account. Musl sends back an asterisk when a password exceeds 256 bytes, and OpenSSH accepts that asterisk as a match for the stored value on passwordless accounts. An attacker can log in to a no-password Alpine account using a password between 257 and 1,024 bytes.

Attackers can crack systems running OpenSSH with musl to gain unauthenticated entry to high-privilege accounts in seconds. The exposure reaches Alpine, Buildroot, OpenWrt, and Yocto with PAM disabled and password logins on. OpenWrt defaults to Dropbear, so the default install is not exposed; the issue appears only when someone adds the OpenSSH server. Systems that are not Linux, use glibc, or rely on PAM are not affected, said Damien Miller of OpenSSH.

Alpine builds the openssh-server package without PAM and enables password logins by default. Alpine no-password accounts include root, key-only users, LDAP users, and alpine cloud users, a condition researcher Ozgun Kultekin dates to 2016. Root normally requires key-based login because PermitRootLogin uses prohibit-password, yet doas can get around that restriction. More than 30 million downloads of Alpine’s Docker image occur each week, and the distribution runs on routers, embedded devices, containers, microservices, and other applications.

Alpine fixed versions 3.21.10, 3.22.8, 3.23.8, and 3.24.4, and it also patched unsupported branches from 3.16 through 3.21. Tiny-cloud images from 3.18.11 through 3.24.3 give the alpine user passwordless doas, and they become vulnerable as soon as any $6$ hash exists. Older tiny-cloud images running in the cloud still require the update or a mitigation.

Researcher Ozgun Kultekin disclosed SSHole last week. The OpenSSH project shipped version 10.6p2 on November 5, and exploit code appeared about four hours after that. No one had reported attacks using the flaw as of November 5. Attempts started on November 5 when a proof-of-concept appeared, and the first success came the following day.

GreyNoise saw the first successful intrusion in the wild on November 7 at 00:46 UTC, 40 hours after the fix, and logged 16 successful attack chains from six source IPs tied to post-exploitation. Those 16 attacks are not evidence of wider SSHole activity, according to GreyNoise. Previdian confirmed that attackers succeeded after 20 attempts from 13 IP addresses across nine countries on Nov. 6 and Nov. 8, while WatchTowr said botnets and cryptominers are the only exploiters it has seen so far. watchTower said on November 6 that it saw SSHole exploitation linked to botnets and cryptomining, and Defused saw a small number of actors attempt SSHole exploitation over the weekend, though it was not widespread.

Attackers ran reconnaissance, asked cloud metadata for data, read password hashes and root SSH keys, and changed authorized_keys to keep access. One intruder reached root and installed TAC Agent, but the implant could not connect to tac.vpnla[.]org or receive a command. The backdoor can run shell commands, perform system reconnaissance, transfer files, and update itself, but it lacks built-in persistence, so attackers add a startup service.

GreyNoise said Monday that a group it tracks as GT10 attacked honeypots in Southeast Asia. GT10 carried out mature intrusions against GreyNoise detection systems, and GreyNoise got into a GT10 server and found potential victims and campaign tools. A backdoor used by GT10 has Chinese language comments and looks like AI produced it. GT10 adds Python3 to machines that do not have it so it can run the TAC Agent backdoor, which can run shell commands, perform system reconnaissance, and maintain persistence.

Users should move to OpenSSH 10.6p2 right away, or turn off password authentication or SSH entirely. On Alpine, administrators should run apk upgrade -U -a and then rc-service sshd restart, since upgrading the package does not restart the running daemon. Release notes show that self-built OpenSSH 10.6p2 contains the fix. Administrators should review logs for unusual requests that could indicate exploitation attempts.

If updating is not possible, confirm that key-based login works, keep an existing session open, set PasswordAuthentication to no, run sshd -t to verify the configuration, and restart sshd. Look in /var/log/messages for accepted password logins to accounts that have no password. Review doas activity, new accounts, new files, and authorized keys, and treat any login that cannot be explained as a compromise. When a login cannot be ruled out, the machine should be treated as compromised.

In version 10.6p2, sshd refuses to accept matches on stored fields shorter than four characters, and OpenSSH describes this as a workaround. Damien Miller advised users to set PasswordAuthentication to no or disable SSH right away. Miller said, “set PasswordAuthentication=no or disable SSH for these systems IMMEDIATELY.”

OpenSSH has issued a fix that stops these attacks from working. OpenSSH rates the flaw critical, and the patched 10.6p2 release is available, along with Alpine fixes going back to version 3.16.