Overview
Hackers are actively exploiting "SSHole" (CVE-2026-123158), an authentication flaw in OpenSSH on certain musl-based Linux systems, including Alpine, to run commands, steal credentials, and establish persistence. OpenSSH 10.6p2, released November 5, contains the fix.
Root Cause
An oversized password makes musl's password-hashing function return * on error. OpenSSH mistakenly treats that value as a match for accounts whose stored hash is *, meaning locked or password-disabled accounts. Accounts with valid password hashes are not affected, and exploitation requires specific authentication settings.
Where the targeted account has passwordless administrative privileges, the result can be root access. The article does not specify an exact affected version range.
Exploitation Timeline
- November 5: A proof-of-concept appeared about four hours after the fix, and attempts began the same day.
- November 7, 00:46 UTC: GreyNoise recorded the first successful in-the-wild exploitation, about 40 hours after the fix, and logged 16 successful chains from six source IPs.
- Previdian observed 20 attempts from 13 IP addresses in nine countries.
- watchTower tied activity to botnet and cryptomining operations; Defused saw only a small number of actors.
Post-exploitation activity included reconnaissance, cloud metadata queries, attempts to read password hashes and root SSH keys, and edits to authorized_keys. One attacker installed a Python-based command-and-control implant called TAC Agent, which could not reach its C2 server.
Mitigation
- Update OpenSSH to 10.6p2 as soon as possible, or disable SSH password authentication on affected systems.
- Look for unexpected successful password logins to accounts whose
/etc/shadowpassword field is*. - Audit
authorized_keysfiles for unauthorized keys. - Search for TAC Agent files and unexpected startup services.
- Review cloud metadata access logs on hosts that may have been reached.
Containers and images built on Alpine are worth checking, since they commonly run musl.