Threat actors are attempting to exploit CVE-2026-123158, codenamed SSHole (CVSS 8.1), a recently disclosed OpenSSH flaw that allows sign-ins to accounts that have no password set. Threat-intelligence firm Previdian reported the first exploitation attempt less than nine hours after the CVE was published, and confirmed root access on an Alpine Linux honeypot.
How the Bug Works
SSHole affects OpenSSH on musl libc with PAM disabled, which includes Alpine Linux's default OpenSSH server configuration. For a password-disabled account whose password field holds *, an attacker can supply an arbitrary password of 257 to 1,024 bytes. The hash attempt fails and returns an asterisk. sshd then compares that asterisk with the one stored in the account's password field, and the login succeeds.
Conditions for exploitation:
- The target account's password field is
*. - Another local account carries a
$5$or$6$hash. - Password authentication is enabled.
Researcher Özgün Kültekin of Wakefield found the flaw. It was fixed in OpenSSH 10.6p2 on 5 November.
Exploitation in the Wild
Previdian logged eight attempts from a single IP address in Japan. The attacker ran basic reconnaissance commands (id, uname, hostname) over non-interactive SSH sessions. Previdian added the bug to its own known-exploited list. CISA has not added it to KEV, and other vendor write-ups published on 6 November describe no confirmed in-the-wild exploitation, so Previdian is currently the only source for the exploitation claim.
Who Is Affected
Alpine Linux, OpenWrt, Buildroot and Yocto are affected. On official Alpine tiny-cloud images from 3.18.11 through 3.24.3, the alpine account has passwordless doas access, which makes a successful login equal to root.
Recommended Actions
- Upgrade to OpenSSH 10.6p2 or your distribution's patched package.
- Until patched, disable SSH password authentication (
PasswordAuthentication no) and use keys. - Audit
/etc/shadowfor accounts with*in the password field and lock or remove ones you do not need. - Review auth logs for long-password login attempts and unexpected sessions on Alpine-based hosts and containers.