Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcriticalExploited in the wild

OpenSSH SSHole bypass exploited; CISA sets Nov. 12 deadline

17 sources · 20 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

CVE-2026-123158 is under limited active exploitation; OpenSSH 10.6p2 fixes it and CISA’s KEV deadline is November 12.

CVE-2026-123158, called SSHole, is an authentication bypass in OpenSSH before 10.6p2 on musl-based Linux without PAM, including Alpine and OpenWrt. A long password can make musl’s crypt return *, which OpenSSH treats as a match for accounts whose stored password field is *; accounts with valid hashes are not bypassed. OpenSSH 10.6p2, released November 5, fixes it, and Alpine has backports. Exploitation has been confirmed since November 6, including a successful root login on an Alpine honeypot plus botnet, cryptominer, reconnaissance, and key-theft activity. CISA added the flaw to the KEV catalog on November 9; federal agencies must mitigate or stop use by November 12. Ransomware use is listed as unknown.

Key facts
  • CVE-2026-123158, CVSS 8.1, fixed in OpenSSH 10.6p2.
  • Needs musl, no PAM, and PasswordAuthentication enabled.
  • Trigger described as passwords of 257–1,024 characters.
  • Alpine backports: edge 10.6_p2-r0 and 3.24 10.3_p1-r2.
  • Mitigation: set PasswordAuthentication no.
  • KEV due date November 12, 2026; ransomware use unknown.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Nov 5, 2026OpenSSH 10.6p2 released, fixing SSHole. · Help Net Security
  2. Nov 5, 2026Ullrich recorded 232 long-password requests. · Cyber Security News
  3. Nov 6, 2026Previdian and others first observed exploitation attempts. · SecurityWeek
  4. Nov 7, 2026GreyNoise recorded successful exploitation on honeypots. · BleepingComputer
  5. Nov 9, 2026CISA added CVE-2026-123158 to the KEV catalog. · CISA Known Exploited Vulnerabilities

What each outlet adds

beyond the shared facts
  • Help Net SecuritySuccessful Alpine honeypot root login under nine hours; Japan source IP.
  • Horizon3.aiAlpine 3.16–3.24 and edge affected; named backport package versions.
  • BleepingComputerGreyNoise: 16 successful chains from six IPs; TAC Agent never reached C2.
  • The Hacker NewsPrevidian count of 22 attempts from 14 IP addresses.
  • Cyber Security NewsUllrich logged 232 requests Nov. 5 and 713 on Nov. 6.
CVEs
CVE-2026-123158CVE-2026-102895CVE-2026-116779CVE-2026-123218
Vendors
Red HatOpenSSHIBMSignalWireOpenBSDGPUStackAlpine LinuxOpenWrt
Products
OpenSSHmuslAlpineFreeSWITCHAspera FaspexAlpine LinuxGPUStackmusl libc
Malware
TAC Agentbotnetscrypto miners
Organizations
watchTowrPrevidianAlpine LinuxCISAGreyNoiseDefused CyberUlex Innovative SystemsDefusedwatchTowerSafe Security
Countries
United StatesJapan

Coverage

oldest first · one row per article · UTC
  1. · 6d ago CSO OnlineFirst report

    OpenSSH flaw allows access to password-disabled accounts on musl Linux

    Attackers bypass authentication on Alpine Linux cloud images by sending long passwords; emergency fix in OpenSSH 10.6p2.

  2. · 6d ago GBHackers

    OpenSSH sshole Flaw Allows Login to Passwordless Accounts

    OpenSSH sshole flaw lets attackers log into password-disabled accounts using 257-1024 character passwords on musl-based systems.

  3. · 6d ago SOCRadar

    OpenSSH password bypass fixed on Alpine Linux

    A password bypass vulnerability in OpenSSH on Alpine Linux has been addressed in a security update.

  4. · 6d ago SecurityWeek

    OpenSSH Patches SSHole Authentication Bypass

    CVE-2026-123158 lets attackers log in with passwords 257-1024 characters on Alpine Linux without PAM.

  5. · 6d ago Help Net Security

    OpenSSH sshole flaw exploited in the wild hours after disclosure (CVE-2026-123158)

    Previdian detected successful root access on an Alpine Linux honeypot within hours of disclosure.

  6. · 6d ago DataBreaches.net

    Long passwords bypass SSH on musl-based Alpine and OpenWrt

    Researcher Özgün Kültekin dubbed the decade-old bug sshole; emergency updates exist, with no attacks confirmed here.

  7. · 6d ago The Hacker News

    Hackers Exploit OpenSSH SSHole Flaw Within Hours of Disclosure

    Attackers gain root access on Alpine Linux honeypot via CVE-2026-123158; patch released in OpenSSH 10.6p2

  8. · 6d ago Horizon3.ai

    CVE-2026-123158: OpenSSH musl auth bypass enables RCE

    Exploitation confirmed in the wild for musl-based OpenSSH before 10.6p2; fixed in 10.6p2 with Alpine backports.

  9. · 5d ago Lobsters · security

    Musl libc '*' sentinel enables unauthenticated shell on Alpine sshd

    Unauthenticated users gain shell access on musl-based Alpine AWS images due to crypt function behavior and sshd handling.

  10. · 4d ago SANS Internet Storm Center

    Scans for SSHole vulnerability (CVE-2026-123158) increase in honeypots

    Honeypots report increase in SSH attacks for sshole starting November 1, with first exploits on November 5.

  11. · 4d ago CISA Known Exploited Vulnerabilities

    CISA lists OpenSSH auth bypass in KEV catalog (CVE-2026-123158)

    Federal agencies must apply vendor mitigations or stop using the product by November 12, 2026.

  12. · 3d ago Cyber Security News

    Hackers Begin Exploiting OpenSSH SSHole Authentication Bypass Vulnerability

    SANS researcher reports active exploitation attempts against OpenSSH SSHole flaw allowing access to password-disabled accounts; fixes available.

  13. · 3d ago SecurityWeek

    Hackers Exploit SSHole Authentication Bypass in OpenSSH (CVE-2026-123158)

    Attackers supply any password 257-1024 characters long to bypass authentication on Alpine and musl-based Linux systems.

  14. · 3d ago BleepingComputer

    Attackers exploit OpenSSH SSHole auth bypass on musl Linux (CVE-2026-123158)

    GreyNoise logged 16 successful chains from six IPs after the 10.6p2 fix; one install of TAC Agent never reached its C2.

  15. · 3d ago Ars Technica · Security

    OpenSSH musl flaw CVE-2026-123158 exploited for SSH access

    The bug needs musl, no PAM, a SHA-256 or SHA-512 password account, and a passwordless shadow entry; Alpine is most exposed.

  16. · 2d ago The Hacker News

    CISA adds exploited OpenSSH, GPUStack, FreeSWITCH, and IBM flaws to KEV

    FCEB agencies must apply fixes by November 12; SSHole activity includes miners, metadata queries, and a Python C2 agent.

  17. · 2d ago Schneier on Security

    OpenSSH-musl flaw lets oversized passwords bypass blocked logins

    The decade-old *sshole bug affects certain Alpine and other musl-based accounts set to reject password authentication.

  18. · 2d ago Cyber Security News

    CISA confirms active exploitation of OpenSSH SSHole bypass

    Remote attackers can log into certain Linux accounts without a password when OpenSSH before 10.6p2 uses musl without PAM.

  19. · 2d ago Security Affairs

    CISA adds GPUStack, FreeSWITCH, OpenSSH, and Faspex flaws to KEV

    Three flaws have confirmed exploitation; GPUStack and FreeSWITCH score 9.8 and allow admin or code execution.

  20. · 1d ago Okta Security

    Okta says platform not affected by OpenSSH SSHole flaw

    Okta says CVE-2026-123158 needs configurations it does not use and that admin access is not on the public internet.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-102895
Authentication bypass in GPUStack before 2.2.0
9.8<1%KEVPoC
KEV
CVE-2026-116779
Arbitrary command execution in FreeSWITCH sofia_presence_handle_sip_i_message()
9.82%KEVPoC ×2
KEV
CVE-2026-123158
Password bypass in OpenSSH before 10.6p2 on musl without PAM
8.119%KEVPoC ×18
KEV
CVE-2026-123218
Authorization bypass to admin in IBM Aspera Faspex 5.0.x
9.8<1%KEV
KEV