Exploited OpenSSH SSHole flaw added to CISA KEV catalog
First merged summary.
CVE-2026-123158, an OpenSSH password-auth bypass on musl Linux, is being exploited; CISA set a November 12 deadline.
GreyNoise and SANS report active scanning and exploitation of CVE-2026-123158, nicknamed SSHole, in OpenSSH on musl-based Linux such as Alpine. An oversized password can authenticate to accounts configured to reject password logins. SANS honeypots saw attempts rise from November 1 and first all-A exploit attempts on November 5, with some logins likely succeeding. CISA added the flaw to its Known Exploited Vulnerabilities catalog and ordered federal agencies to apply vendor mitigations or stop using the product by November 12. No fixed version is named, and known ransomware use is listed as unknown.
- SSHole lets an oversized password authenticate accounts set to reject password logins.
- It affects OpenSSH on musl-based Linux; Alpine is cited as an example.
- SANS honeypots saw attempts rise November 1 and first exploits November 5.
- GreyNoise reports exploitation attempts and successful exploitation.
- Federal agencies must mitigate or discontinue use by November 12, 2026.
- No fixed version is named; known ransomware use is listed as unknown.
Timeline
dated events in the reporting · oldest first- Nov 1, 2026SSH password attempts for SSHole began increasing. · SANS Internet Storm Center
- Nov 5, 2026First exploit attempts used an all-A password. · SANS Internet Storm Center
- Nov 6, 2026GreyNoise reported scanning and successful exploitation. · GreyNoise
- Nov 9, 2026CISA added CVE-2026-123158 to the KEV catalog. · CISA Known Exploited Vulnerabilities
What each outlet adds
beyond the shared facts- GreyNoiseNames SSHole and reports successful exploitation on musl Linux.
- SANS Internet Storm CenterHoneypot dates, all-A passwords, and varied source networks.
- CISA Known Exploited VulnerabilitiesKEV listing, November 12 deadline, and unknown ransomware use.
Coverage
oldest first · one row per article · UTC- · 5d ago
GreyNoiseFirst report
OpenSSH SSHole flaw exploited on musl Linux (CVE-2026-123158)
An oversized password can log in to accounts configured to reject password authentication.
- · 3d ago
SANS Internet Storm Center
Scans for SSHole vulnerability (CVE-2026-123158) increase in honeypots
Honeypots report increase in SSH attacks for sshole starting November 1, with first exploits on November 5.
- · 2d ago
CISA Known Exploited Vulnerabilities
CISA lists OpenSSH auth bypass in KEV catalog (CVE-2026-123158)
Federal agencies must apply vendor mitigations or stop using the product by November 12, 2026.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-123158 | Password bypass in OpenSSH before 10.6p2 on musl without PAM | 8.1 | 17% | KEVPoC ×16 | KEV |