Hackers Exploit OpenSSH SSHole Flaw Within Hours of Disclosure
Original title: Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot
Attackers gain root access on Alpine Linux honeypot via CVE-2026-123158; patch released in OpenSSH 10.6p2
Threat actors are exploiting CVE-2026-123158, codenamed SSHole, in OpenSSH. The flaw allows unauthenticated sign-ins to accounts without passwords on musl-based systems. Previdian observed exploitation within 9 hours of disclosure and confirmed successful root on a honeypot. The issue dates back to a 2016 patch. Affected users should upgrade to OpenSSH 10.6p2.
Unconfirmed: No specific threat actors attributed; exploitation from Japan IP
- Exploitation observed less than 9 hours after disclosure
- Confirmed root access on Alpine Linux honeypot
- Requires account with password hash '*'
- Affects systems with PAM disabled
- No impact on glibc-based distributions
Impact: unauthenticated remote code execution as arbitrary user with existing permissions
- 1.Upgrade to OpenSSH 10.6p2
- 2.Review /var/log/messages for suspicious logins
- CVEs
- CVE-2026-123158
- Vendors
- OpenSSH
- Organizations
- PrevidianSafe SecurityAlpine Linux
- Countries
- Japan
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-123158 | Password bypass in OpenSSH before 10.6p2 on musl without PAM | 8.1 | 1% | PoC ×13 |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 89.116.89.18 | an IP address geolocated to Japan. "The observed source IP, 89.116.89[.]18, used oversized passwords to bypass authentication and ra |
From the original article
2 min read at thehackernews.com
Threat actors are attempting to exploit a recently disclosed security flaw impacting OpenSSH that can enable sign-ins to accounts that have no password set, according to Previdian. The vulnerability, tracked as CVE-2026-123158 (CVSS score: 8. 1) and codenamed SSHole (or *sshole), impacts Linux systems that run OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled,
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.