Attackers exploit OpenSSH SSHole auth bypass on musl Linux (CVE-2026-123158)
Original title: Hackers exploit SSHole OpenSSH flaw to breach Linux systems
GreyNoise logged 16 successful chains from six IPs after the 10.6p2 fix; one install of TAC Agent never reached its C2.
Attackers are exploiting SSHole (CVE-2026-123158), an OpenSSH authentication bypass on certain musl-based Linux systems, including Alpine. An oversized password can make musl return *, which OpenSSH treats as a match for accounts whose password hash is *. OpenSSH 10.6p2, released November 5, fixes it; a proof of concept appeared about four hours later, and GreyNoise recorded successful exploitation on November 7. Observed activity included reconnaissance, cloud metadata queries, SSH-key theft attempts, authorized_keys changes, and one TAC Agent install that never contacted tac.vpnla[.]org.
Unconfirmed: Chinese-language implant strings may indicate origin, but GreyNoise does not attribute the activity.
- The bug does not affect accounts that already have valid password hashes.
- Defused saw only a small number of attempts and said activity was not widespread.
- Previdian logged 20 attempts from 13 IPs in nine countries.
- watchTower linked November 6 exploitation to botnets and cryptomining.
- GreyNoise also logged 27.5 million port-22 scans not confirmed as SSHole.
Impact: Authentication bypass, command execution, and possible root access
| Product | Affected | Fixed in |
|---|---|---|
| OpenSSH | musl-based Linux systems, including Alpine, before the fix | 10.6p2 |
- 1.Update OpenSSH to 10.6p2 or disable SSH password authentication on affected systems.
- 2.Check * password-hash accounts for unexpected logins, unauthorized SSH keys, and TAC Agent files or startup services.
- CVEs
- CVE-2026-123158
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1552.004 Private KeysT1552.005 Cloud Instance Metadata APIT1098.004 SSH Authorized Keys
- Vendors
- OpenSSH
- Products
- Alpine Linux
- Malware
- TAC Agent
- Organizations
- GreyNoiseDefusedPrevidianwatchTower
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-123158 | Password bypass in OpenSSH before 10.6p2 on musl without PAM | 8.1 | 1% | PoC ×13 |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | vpnla.org | couldn’t reach its command-and-control (C2) server at ‘tac.vpnla[.]org,’ and never received a task. TAC Agent and C2 exchange So |
From the original article
3 min read at bleepingcomputer.com
Hackers are actively exploiting the "SSHole" vulnerability (CVE-2026-123158) in OpenSSH to execute commands, steal credentials, and establish persistent access. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.