CISA confirms active exploitation of OpenSSH SSHole bypass
Original title: CISA Confirms Hackers are Exploiting SSHole, the OpenSSH Vulnerability
Remote attackers can log into certain Linux accounts without a password when OpenSSH before 10.6p2 uses musl without PAM.
CISA added CVE-2026-123158, called SSHole, to the KEV catalog on November 9, 2026, with a November 12 deadline under Binding Operational Directive 26-04. The CVSS 8.1 flaw accepts login when password authentication is on, musl crypt() returns * for an overly long password, and the target account’s stored field is *. OpenSSH 10.6p2 has the upstream workaround. Ransomware use is listed as unknown.
Unconfirmed: SANS logs show suspicious long-password attempts, not confirmed successful sessions; CISA separately warns of exploitation.
- The documented trigger is a password of 257 to 1,024 bytes.
- Alpine Linux is one affected platform; an Alpine container alone is not exposure.
- Ullrich recorded 232 long-password requests on November 5 and 713 on November 6.
- Accounts with valid password hashes are not bypassed by this mechanism.
- If patching must wait, PasswordAuthentication no blocks this path.
Impact: Passwordless remote login to accounts whose password field is *
| Product | Affected | Fixed in |
|---|---|---|
| OpenSSH | before 10.6p2, on Linux with musl and without PAM | 10.6p2 |
- 1.Install OpenSSH 10.6p2 or a patched distribution package and restart sshd.
- 2.If updates must wait, set PasswordAuthentication no after confirming key access.
- 3.Check password logins to accounts without usable passwords, privilege changes, and new keys.
- CVEs
- CVE-2026-123158
- Vendors
- OpenSSH
- Products
- Alpine Linux
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-123158 | Password bypass in OpenSSH before 10.6p2 on musl without PAM | 8.1 | 17% | KEVPoC ×15 | KEV |
From the original article
2 min read at cybersecuritynews.com
CISA has flagged active exploitation of SSHole, an OpenSSH authentication bypass (CVE-2026-123158) that lets remote attackers access certain Linux accounts without a valid password or SSH key. The OpenSSH flaw affects specific server configurations, carries a CVSS score of 8. 1, and was added to CISA’s KEV catalog on November 9, 2026, with a November 12 […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.