OpenSSH SSHole flaw exploited on musl Linux (CVE-2026-123158)
Original title: Global Event: SSHole (CVE-2026-123158) Live Activity Report
An oversized password can log in to accounts configured to reject password authentication.
GreyNoise says it is monitoring scanning, exploitation attempts and successful exploitation of CVE-2026-123158, called SSHole. The flaw affects OpenSSH on musl-based Linux, such as Alpine, and lets an oversized password authenticate to accounts set to reject password logins. This item is a summary of a longer GreyNoise Labs report.
Unconfirmed: This summary does not state how many systems were successfully compromised.
- The flaw is nicknamed SSHole.
- It affects OpenSSH on musl-based Linux, with Alpine cited as an example.
- GreyNoise reports both attempts and successful exploitation.
- No fixed version is named in this summary.
Impact: Password login to accounts set to reject passwords
| Product | Affected |
|---|---|
| OpenSSH | musl-based Linux such as Alpine |
- CVEs
- CVE-2026-123158
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-123158 | Password bypass in OpenSSH before 10.6p2 on musl without PAM | 8.1 | 17% | KEVPoC ×16 | KEV |
From the original article
1 min read at greynoise.io.png&w=1280&q=75)
GreyNoise is monitoring scanning, exploitation attempts, and successful exploitation of CVE-2026-123158, also known as "SSHole," a flaw in OpenSSH on musl-based Linux (such as Alpine) that lets an oversized password authenticate to accounts configured to reject password logins.
greynoise.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.