OpenSSH sshole flaw exploited in the wild hours after disclosure (CVE-2026-123158)
Original title: OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158)
Previdian detected successful root access on an Alpine Linux honeypot within hours of disclosure.
The OpenSSH sshole flaw lets remote attackers log into passwordless accounts on musl-based systems including Alpine Linux. It was fixed in OpenSSH 10.6p2 on November 5. Previdian founder Ryan Dewhurst reported sensors catching attacks starting less than nine hours after publication, with one successful root login on a honeypot. The flaw stems from musl's crypt function behavior matching passwordless account hashes. CISA has not added it to KEV.
Unconfirmed: CISA has not included the vulnerability in its KEV catalog
- OpenSSH 10.6p2 fixes the issue
- Affects musl-based systems without PAM
- Successful root access observed on Alpine honeypot
- Source IP from Japan
- PoCs posted on GitHub but unverified
Impact: Remote unauthenticated login to passwordless accounts
- 1.Upgrade to OpenSSH 10.6p2
- 2.Disable PasswordAuthentication on musl-based systems
- 3.Restart sshd after patching
- CVEs
- CVE-2026-123158
- Vendors
- OpenSSH
- Organizations
- PrevidianAlpine Linux
- Countries
- Japan
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-123158 | Password bypass in OpenSSH before 10.6p2 on musl without PAM | 8.1 | 1% | PoC ×13 |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 89.116.89.18 | enSSH,” he told Help Net Security. “The observed source IP, 89.116.89[.]18, used oversized passwords to bypass authentication and ra |
From the original article
4 min read at helpnetsecurity.com
An OpenSSH flaw that lets remote attackers log into passwordless accounts on Alpine Linux and other musl-based systems is being exploited, threat intelligence firm Previdian has warned. The flaw (CVE-2026-123158), nicknamed sshole by Wakefield researcher Özgün Kültekin, was fixed in OpenSSH 10. 6p2 on November 5.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.