Attackers exploit OpenSSH SSHole auth bypass on musl Linux (CVE-2026-123158)New
GreyNoise logged 16 successful chains from six IPs after the 10.6p2 fix; one install of TAC Agent never reached its C2.
82
Vendor
OpenSSH
- Mentions · 7d18
- Mentions · 30d19
- All mentions22
- First seenAug 17, 2026
- Last mentioned20m ago
Timeline
22 articles · newest firstHackers Exploit SSHole Authentication Bypass in OpenSSH (CVE-2026-123158)
Attackers supply any password 257-1024 characters long to bypass authentication on Alpine and musl-based Linux systems.
75
Hackers Begin Exploiting OpenSSH SSHole Authentication Bypass Vulnerability
SANS researcher reports active exploitation attempts against OpenSSH SSHole flaw allowing access to password-disabled accounts; fixes available.
70
CVE-2026-123158: OpenSSH musl auth bypass enables RCE
Exploitation confirmed in the wild for musl-based OpenSSH before 10.6p2; fixed in 10.6p2 with Alpine backports.
85
Hackers Exploit OpenSSH SSHole Flaw Within Hours of Disclosure
Attackers gain root access on Alpine Linux honeypot via CVE-2026-123158; patch released in OpenSSH 10.6p2
75
Long passwords bypass SSH on musl-based Alpine and OpenWrt
Researcher Özgün Kültekin dubbed the decade-old bug sshole; emergency updates exist, with no attacks confirmed here.
76
OpenSSH sshole flaw exploited in the wild hours after disclosure (CVE-2026-123158)
Previdian detected successful root access on an Alpine Linux honeypot within hours of disclosure.
80
OpenSSH Patches SSHole Authentication Bypass
CVE-2026-123158 lets attackers log in with passwords 257-1024 characters on Alpine Linux without PAM.
70
OpenSSH password bypass fixed on Alpine Linux
A password bypass vulnerability in OpenSSH on Alpine Linux has been addressed in a security update.
35
OpenSSH sshole Flaw Allows Login to Passwordless Accounts
OpenSSH sshole flaw lets attackers log into password-disabled accounts using 257-1024 character passwords on musl-based systems.
50
SSHHole: OpenSSH allows any password over 256 characters on musl systems
Bypass authentication in OpenSSH musl versions with any string longer than 256 characters, affecting Alpine, OpenWRT and IoT devices.
75
OpenSSH flaw allows access to password-disabled accounts on musl Linux
Attackers bypass authentication on Alpine Linux cloud images by sending long passwords; emergency fix in OpenSSH 10.6p2.
70
OpenSSH 10.6p2 password authentication bypass via invalid hash fields
OpenSSH 10.6p2 resolves a password authentication bypass vulnerability affecting accounts with invalid password hash fields in musl libc.
60
OpenSSH fixed for *sshole long-password root flaw on musl systems
Attackers can gain root on musl libc OpenSSH by supplying 257-1024 character passwords when no PAM is used.
35
OpenSSH flaw lets attackers log into password-disabled Linux accounts
Attackers can log into accounts with asterisk password hashes on musl-based systems by submitting oversized passwords; fixed in OpenSSH 10.6p2.
50
OpenSSH 10.6p2 fixes long password bypass on Alpine Linux SSH
Long passwords bypass SSH authentication for passwordless accounts on Alpine Linux; OpenSSH 10.6p2 and Alpine updates released.
80
Musl libc allows long passwords to bypass root lock in OpenSSH
Passwords longer than 256 bytes accepted on musl-based SSHD despite * lock in shadow.
35
OpenSSH 10.6p2 released with musl libc workaround
OpenSSH 10.6p2 includes immediate mitigation for critical vulnerability affecting Linux systems using musl libc without PAM.
95
USN-8928-1: OpenSSH vulnerabilities
Ubuntu patched OpenSSH flaws that could allow unintended SFTP writes or leak GSSAPI credentials.
36
Multiple OpenSSH Vulnerabilities Could Enable Plaintext Recovery, File Write and Injection Attacks
OpenSSH 10.6 fixes compression-based plaintext recovery, SFTP path writes, and username shell injection.
64
USN-8804-1: OpenSSH vulnerabilities
Ubuntu patched two OpenSSH flaws, including command execution on 14.04 and an ECDSA bypass.
34
Backdoor Xz Utils Linux Open Source
Infosecurity Magazine covers the XZ Utils open-source backdoor, a malicious implant in liblzma that targeted OpenSSH on major Linux distributions.
60
Related CVEs
by mentions- CVE-2026-1231581%8.1Password bypass in OpenSSH before 10.6p2 on musl without PAM
- CVE-2024-309486%10.0Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0
- CVE-2026-35386<1%8.1In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line
- Credential persistence after failed GSSAPI auth in OpenSSH
- GSSAPI auth-state persistence flaw in OpenSSH sshd
- CVE-2026-35387<1%6.5OpenSSH before 10.3 can use unintended ECDSA algorithms
- Directory traversal in OpenSSH sftp recursive copy
- CVE-2016-621089%5.9sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not…
Appears with
- Alpine Linuxorganization · 5
- Alpine Linuxvendor · 4
- Previdianorganization · 3
- OpenSSHproduct · 3
- muslproduct · 2
- Canonicalorganization · 2
- Alpine Linuxproduct · 2
- musl libcproduct · 2
- Wakefieldorganization · 1
- watchTowrorganization · 1
- Safe Securityorganization · 1
- alpinevendor · 1
- muslvendor · 1
- openssh-serverproduct · 1
- OpenWrtvendor · 1
- Risky Businessorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.