Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitycriticalExploited in the wild

Attackers exploit OpenSSH SSHole bypass on musl Linux systems

15 sources · 20 articlesFirst reported Updated ()1
What's new

November 9: BleepingComputer adds GreyNoise’s November 7 record of 16 successful chains from six IPs, including key theft and one TAC Agent install that never reached its C2.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

CVE-2026-123158 remains under active exploitation after OpenSSH 10.6p2; GreyNoise logged successful chains and one failed TAC Agent install.

CVE-2026-123158, called SSHole, lets remote attackers log into passwordless accounts on OpenSSH built with musl libc and without PAM by sending passwords 257–1,024 characters long. Researcher Özgün Kültekin found the decade-old bug; it affects Alpine Linux 3.16–3.24 and edge, OpenWrt, and other musl-based systems, not glibc or PAM setups. OpenSSH 10.6p2, released November 5, fixes it, with Alpine backports. Exploitation began within hours. GreyNoise later logged 16 successful attack chains from six IPs, including reconnaissance and SSH-key theft, plus one TAC Agent install that never reached its command server. Defused said attempts were few and not widespread; CISA has not added the flaw to KEV.

Key facts
  • CVE-2026-123158, CVSS 8.1, affects musl OpenSSH without PAM.
  • Bypass uses passwords of 257–1,024 characters against accounts whose hash is *.
  • Fixed in OpenSSH 10.6p2; Alpine edge 10.6_p2-r0 and 3.24 10.3_p1-r2.
  • Mitigation: set PasswordAuthentication no and restart sshd.
  • GreyNoise: 16 successful chains from six IPs; TAC Agent never contacted C2.
  • Previdian logged 20 attempts from 13 IPs in nine countries.
Analyze CVE-2026-123158 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Nov 5, 2026OpenSSH 10.6p2 released, fixing SSHole · Help Net Security
  2. Nov 5, 2026SANS sees rising long-password SSH requests · Cyber Security News
  3. Nov 6, 2026Previdian and watchTower see early exploitation · SecurityWeek
  4. Nov 7, 2026GreyNoise records successful exploitation chains · BleepingComputer

What each outlet adds

beyond the shared facts
  • BleepingComputerGreyNoise’s 16 chains, six IPs, and failed TAC Agent install
  • SecurityWeekPrevidian’s 20 attempts from 13 IPs in nine countries
  • Horizon3.aiAlpine backport package versions and PasswordAuthentication mitigation
  • DataBreaches.netNames researcher Özgün Kültekin and cites OpenWrt exposure
  • Help Net SecurityCISA has not added the flaw to KEV
CVEs
CVE-2026-123158
Vendors
OpenSSHAlpine LinuxOpenWrtAlpine
Products
Alpine Linuxopenssh-servermuslmusl libcOpenSSH
Malware
TAC Agentbotnetscrypto miners
Organizations
Alpine LinuxGreyNoiseDefusedPrevidianwatchTowerSafe SecurityWakefieldwatchTowr
Countries
Japan

Coverage

oldest first · one row per article · UTC
  1. · 4d ago Lobsters · securityFirst report

    Musl libc allows long passwords to bypass root lock in OpenSSH

    Passwords longer than 256 bytes accepted on musl-based SSHD despite * lock in shadow.

  2. · 4d ago Hacker News · security

    Alpine OpenSSH bypass lets attackers log in without the password

    A reachable sshd built without PAM accepts one 257-to-1024-byte password for accounts whose shadow field is *.

  3. · 4d ago Cyber Security News

    OpenSSH password bypass affects Alpine servers using musl without PAM

    Portable OpenSSH 10.6p2 adds a workaround; Alpine fixes include 3.21.10, 3.22.8, 3.23.8 and 3.24.4, with no CVE assigned.

  4. · 3d ago The Hacker News

    OpenSSH 10.6p2 fixes long password bypass on Alpine Linux SSH

    Long passwords bypass SSH authentication for passwordless accounts on Alpine Linux; OpenSSH 10.6p2 and Alpine updates released.

  5. · 3d ago BleepingComputer

    OpenSSH flaw lets attackers log into password-disabled Linux accounts

    Attackers can log into accounts with asterisk password hashes on musl-based systems by submitting oversized passwords; fixed in OpenSSH 10.6p2.

  6. · 3d ago The Register · Security

    OpenSSH fixed for *sshole long-password root flaw on musl systems

    Attackers can gain root on musl libc OpenSSH by supplying 257-1024 character passwords when no PAM is used.

  7. · 3d ago oss-security

    OpenSSH 10.6p2 password authentication bypass via invalid hash fields

    OpenSSH 10.6p2 resolves a password authentication bypass vulnerability affecting accounts with invalid password hash fields in musl libc.

  8. · 3d ago Ars Technica · Security

    Alpine Linux SSH lets attackers log in without password via *sshole

    Alpine Linux and other distributions using OpenSSH with musl without PAM allow passwordless SSH access when SHA256 or SHA512 hashes and passwordless accounts are configured.

  9. · 3d ago CSO Online

    OpenSSH flaw allows access to password-disabled accounts on musl Linux

    Attackers bypass authentication on Alpine Linux cloud images by sending long passwords; emergency fix in OpenSSH 10.6p2.

  10. · 3d ago GBHackers

    OpenSSH sshole Flaw Allows Login to Passwordless Accounts

    OpenSSH sshole flaw lets attackers log into password-disabled accounts using 257-1024 character passwords on musl-based systems.

  11. · 3d ago SOCRadar

    OpenSSH password bypass fixed on Alpine Linux

    A password bypass vulnerability in OpenSSH on Alpine Linux has been addressed in a security update.

  12. · 3d ago SecurityWeek

    OpenSSH Patches SSHole Authentication Bypass

    CVE-2026-123158 lets attackers log in with passwords 257-1024 characters on Alpine Linux without PAM.

  13. · 3d ago Help Net Security

    OpenSSH sshole flaw exploited in the wild hours after disclosure (CVE-2026-123158)

    Previdian detected successful root access on an Alpine Linux honeypot within hours of disclosure.

  14. · 3d ago DataBreaches.net

    Long passwords bypass SSH on musl-based Alpine and OpenWrt

    Researcher Özgün Kültekin dubbed the decade-old bug sshole; emergency updates exist, with no attacks confirmed here.

  15. · 3d ago The Hacker News

    Hackers Exploit OpenSSH SSHole Flaw Within Hours of Disclosure

    Attackers gain root access on Alpine Linux honeypot via CVE-2026-123158; patch released in OpenSSH 10.6p2

  16. · 2d ago Horizon3.ai

    CVE-2026-123158: OpenSSH musl auth bypass enables RCE

    Exploitation confirmed in the wild for musl-based OpenSSH before 10.6p2; fixed in 10.6p2 with Alpine backports.

  17. · 1d ago Lobsters · security

    Musl libc '*' sentinel enables unauthenticated shell on Alpine sshd

    Unauthenticated users gain shell access on musl-based Alpine AWS images due to crypt function behavior and sshd handling.

  18. · 11h ago Cyber Security News

    Hackers Begin Exploiting OpenSSH SSHole Authentication Bypass Vulnerability

    SANS researcher reports active exploitation attempts against OpenSSH SSHole flaw allowing access to password-disabled accounts; fixes available.

  19. · 4h ago SecurityWeek

    Hackers Exploit SSHole Authentication Bypass in OpenSSH (CVE-2026-123158)

    Attackers supply any password 257-1024 characters long to bypass authentication on Alpine and musl-based Linux systems.

  20. · 20m ago BleepingComputer

    Attackers exploit OpenSSH SSHole auth bypass on musl Linux (CVE-2026-123158)

    GreyNoise logged 16 successful chains from six IPs after the 10.6p2 fix; one install of TAC Agent never reached its C2.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-123158
Password bypass in OpenSSH before 10.6p2 on musl without PAM
8.11%PoC ×13