Hackers Exploiting ‘SSHole’ Authentication Bypass in OpenSSH
The initial exploitation attempts are attributed to botnets and crypto miners, but other threat actors are expected to follow suit.
Threat actors have started exploiting SSHole, a recently patched high-severity authentication bypass vulnerability in OpenSSH.
Tracked as CVE-2026-123158, the flaw is “related to misinterpretation of whether a string is intended to be a password hash” and could let attackers access certain accounts by supplying any password between 257 and 1024 characters.
Successful exploitation could allow attackers to access accounts such as root, which should never accept a password.
On certain Linux distributions that use the musl libc implementation with the Pluggable Authentication Module (PAM) disabled, such as Alpine, Buildroot, OpenWrt, Yocto, and others, these accounts do accept a password.
This happens because the OpenSSH server (sshd) checks the supplied password by hashing it against a stored password hash associated with the username.
When an account has no password hash, as with root on Alpine (where the field is ‘*’), sshd borrows the salt from another account’s hash to process the login attempt. For passwords longer than 256 bytes, musl’s crypt() function fails and, instead of returning NULL, returns ‘*’. Because that matches the ‘*’ stored for the target account, sshd treats the password as correct.
In Alpine, affected accounts include root, any key-only user created with adduser without a password, the Alpine user in the official tiny-cloud images, and any user coming from a directory service through musl-nscd.
Last week, OpenSSH rushed patches for the bug, and Alpine urged users to apply them and restart sshd as soon as possible.
Over the weekend, both WatchTowr and Previdian warned that hackers had started exploiting SSHole in the wild. According to WatchTowr, only botnets and crypto miners have picked it up so far.
“Previdian sensors have observed 20 exploitation attempts, 13 unique attacker IPs, and 9 countries targeting CVE-2026-123158. First observed Nov 06, 2026; last observed Nov 08, 2026,” Previdian said.
Exploitation attempts have also been reported by GreyNoise and Defused.
Users are advised to update to OpenSSH version 10.6p2 as soon as possible. As a mitigation, they can disable password authentication (on by default in OpenSSH) or disable SSH. They should also check logs for unusual requests to identify exploitation attempts.
