Attackers exploit OpenSSH SSHole flaw on Linux systems

BleepingComputer reports that attackers are exploiting CVE-2026-123158 on Linux systems running OpenSSH to run commands, steal credentials, and maintain access.

The vulnerability, nicknamed SSHole, bypasses OpenSSH authentication on musl-based Linux systems without PAM (Pluggable Authentication Modules), including the default OpenSSH server setup in Alpine Linux. Researcher Özgün Kültekin disclosed the flaw last week, and it dates to 2016, according to Kültekin and the *sshole group that uncovered it.

A password longer than 256 bytes causes musl to return an asterisk on error, and OpenSSH treats that asterisk as a match for the stored asterisk in /etc/shadow, a marker normally used to block password logins. The bypass requires PasswordAuthentication set to yes, the OpenSSH default. It needs one account with a SHA256 or SHA512 password hash plus a separate passwordless account marked with an asterisk. Alpine maintainers warned, “An attacker who can reach your SSH port can log in without knowing any password”.

Systems are not affected when they do not run sshd (the OpenSSH daemon), disable password authentication, use openssh-server-pam with UsePAM set to yes, or have locked accounts, and cloud-init images that set PasswordAuthentication to no are also safe. Debian, Ubuntu, and Fedora are not affected because glibc’s crypt() returns NULL on error, while researcher Özgün Kültekin says Dropbear and OpenBSD are safe.

OpenSSH maintainers issued version 10.6p2 on November 5, 2026, fixing the flaw. Alpine published patched packages for every branch from 3.16 to edge, including 3.21.10, 3.22.8, 3.23.8, and 3.24.4. Applying the update leaves the running sshd in place, so administrators must restart the daemon after the upgrade, such as with rc-service sshd restart. Alpine specifically advises running apk upgrade -U -a and then restarting sshd with rc-service sshd restart.

GreyNoise recorded the initial successful intrusion on November 7, 2026, at 00:46 UTC, approximately 40 hours after OpenSSH issued the fix, and logged 16 successful exploitation chains from six source IP addresses tied to post-exploitation activity on networks it protects. In those intrusions, attackers performed system and container reconnaissance, queried cloud metadata services, tried to read root SSH keys, copy password hashes, and alter authorized_keys files to keep access. GreyNoise also logged 27.5 million port-22 scans and 20.1 million attempted SSH sessions, neither confirmed as SSHole attacks, and cautioned that its activity is not representative of broader exploitation. GreyNoise observed Chinese language in the implant’s comments, logs, and errors, which may help indicate the attacker’s origin when combined with other evidence.

One intruder obtained root privileges and installed TAC Agent, a Python command-and-control tool that runs shell commands, gathers reconnaissance, transfers files, and updates itself, but the implant never reached tac.vpnla[.]org and never received a command. TAC Agent lacks built-in persistence, so attackers add a startup service, and GreyNoise observed a missing tool check that returns feedback an automated planner could use to revise attack commands, suggesting possible automated operation. BleepingComputer recommends checking for TAC Agent files or startup services as signs of compromise.

Previdian founder Ryan Dewhurst said, “we’ve confirmed successful root access on a Previdian honeypot running real Alpine Linux and OpenSSH”. Previdian confirmed successful exploitation and counted 20 attempts from 13 attacker IP addresses across nine countries. Its first detected attack arrived under nine hours after CVE publication, and Dewhurst confirmed root access on a honeypot running real Alpine Linux and OpenSSH. As of November 9, 2026, 20 exploitation attempts from 13 unique IP addresses were recorded in Denmark, Iran, Japan, the Netherlands, Norway, Singapore, Sweden, Switzerland, and the U.S.

watchTower reported on November 6, 2026, that it saw SSHole exploitation tied to botnets and cryptomining activity, while Finnish security company Defused observed over the weekend a small number of actors trying to exploit the flaw, describing the activity as not widespread. WatchTowr head of threat intelligence Jake Knott said the attempt costs virtually nothing and succeeds easily if it works, and he urged organizations to patch when possible or turn off password-based authentication as a stopgap. Detectify co-founder and principal security researcher Fredrik Almroth said scanning could start within hours and that finding targets is very easy, citing Shodan’s listing of around 22 million systems with SSH open on port 22.

Damien Miller of OpenSSH said, “We are making this release as fast as possible (we learned of the problem yesterday)”. Miller said the defect does not live in sshd, though attackers can exploit it via sshd, and he cited AI agents rapidly rediscovering bugs as the reason for the fast release. He urged users of musl-based Linux without PAM to set PasswordAuthentication to no or disable SSH immediately, posting on Mastodon.

The flaw is a decade old and dates to 2016, according to the researcher who found it and to *sshole, the group that uncovered it. A 2016 OpenSSH change for CVE-2016-6210 caused sshd to borrow another account’s salt and hash passwords for accounts with no usable hash. Since 2012, musl’s crypt() has refused SHA-256 and SHA-512 passwords longer than 256 bytes, returning an asterisk on failure that matches the stored asterisk. Musl added SHA-512 hashing in 2012, and the hashing becomes slower as passwords get longer, so musl caps password hashing at 256 bytes to prevent a long password from keeping a server busy.

Alpine said every release it checked is affected, covering 3.21 through 3.24, edge, and the older 3.16 to 3.20 branches, and Alpine 3.21 reached end of support on November 1, 2026. Alpine’s official tiny-cloud images from 3.18.11 through 3.24.3 are especially vulnerable because they ship with the alpine user and passwordless doas. Alpine’s Docker image has more than 30 million weekly downloads. Other potentially exposed musl-based systems include Void Linux, OpenWrt, Buildroot, Yocto, Adélie Linux, Sabotage Linux, and many Docker images.

Organizations that cannot update should set PasswordAuthentication to no and restart sshd after confirming that key-based login works. Alpine told administrators to search /var/log/messages for Accepted password entries naming accounts without passwords, and to inspect doas use, recent users, files, and authorized_keys. If administrators cannot rule out a login, they should treat the machine as compromised.

A compromise can allow theft of data and credentials, malware installation, server wiping, host takeover, or use as a foothold against other network systems. The CVSS score for CVE-2026-123158 is 8.1.