Hackers Exploit SSHole Authentication Bypass in OpenSSH (CVE-2026-123158)
Original title: Hackers Exploiting ‘SSHole’ Authentication Bypass in OpenSSH
Attackers supply any password 257-1024 characters long to bypass authentication on Alpine and musl-based Linux systems.
Threat actors have started exploiting CVE-2026-123158, a high-severity authentication bypass in OpenSSH. The flaw lets attackers access accounts like root by providing passwords between 257 and 1024 characters. This occurs on distributions using musl libc with PAM disabled, such as Alpine. OpenSSH 10.6p2 patches the issue, and exploitation in the wild has been observed by botnets and crypto miners.
Unconfirmed: Exploitation limited to botnets and crypto miners so far; specific countries unnamed
- Exploitation first observed November 6, 2026
- Previdian detected 20 attempts from 13 unique IPs in 9 countries
- Only botnets and crypto miners observed so far
- Affects root and key-only users on Alpine
- Update to OpenSSH 10.6p2 required
Impact: bypass authentication to access privileged accounts such as root
- 1.update to OpenSSH 10.6p2
- 2.disable password authentication
- 3.disable SSH
- CVEs
- CVE-2026-123158
- Vendors
- OpenSSHAlpine Linux
- Products
- musl libc
- Malware
- botnetscrypto miners
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-123158 | Password bypass in OpenSSH before 10.6p2 on musl without PAM | 8.1 | 1% | PoC ×13 |
From the original article
2 min read at securityweek.com
The initial exploitation attempts are attributed to botnets and crypto miners, but other threat actors are expected to follow suit. The post Hackers Exploiting ‘SSHole’ Authentication Bypass in OpenSSH appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.