Science & Tech · Cybersecurity · 1 hr ago
Hackers exploit OpenSSH authentication flaw on some Linux systems
Attackers are exploiting SSHole, a recently patched flaw in OpenSSH, the software used for secure remote access to computers.
The vulnerability affects some Linux systems using musl, including Alpine, when specific authentication settings are in place.
It can let attackers log in to certain accounts by submitting an unusually long password that the system mistakenly accepts.
A successful attack can expose accounts and allow persistent access, and may lead to root privileges if the account has passwordless administrative access.
Security firms have observed exploitation attempts, though the activity reported so far has not been widespread.
OpenSSH fixed the flaw in version 10.6p2, and administrators are urged to install it and restart the service.
Those who cannot update should disable password authentication or SSH, and check logs, account keys and startup services for signs of unauthorized access.
Hackers are exploiting SSHole, an authentication bypass flaw in OpenSSH tracked as CVE-2026-123158.
The flaw can let attackers access certain accounts on musl-based Linux systems, including Alpine, by submitting an oversized password.
OpenSSH released a fix in version 10.6p2 on November 5, 2026.
Security firms have reported exploitation attempts, including activity involving botnets and cryptomining.
Administrators are advised to update OpenSSH or disable SSH password authentication on affected systems.
- Who
- Threat actors, including activity associated with botnets and cryptominers, are exploiting the flaw.
- What
- SSHole, tracked as CVE-2026-123158, allows authentication bypass in certain OpenSSH configurations.
- When
- Exploitation attempts were reported from November 5, 2026. GreyNoise recorded its first successful exploitation on November 7.
- Where
- Certain musl-based Linux systems, including Alpine and other distributions, are affected.
- Why
- The flaw can make OpenSSH treat an error value from musl’s password-hashing function as a matching password hash.
This story does not have two clearly opposing sides.
OpenSSH released version 10.6p2 to fix SSHole, and proof-of-concept exploit code became available.
BleepingComputer reported successful exploitation the day after attempts began.
GreyNoise recorded its first successful exploitation of SSHole in the wild.
Previdian’s reported observation period ended.
- Vulnerability
- CVE-2026-123158
- OpenSSH fix
- Version 10.6p2, released November 5, 2026
- Password length
- 257 to 1,024 characters can trigger the bypass
- GreyNoise observations
- 16 successful exploitation chains from six source IP addresses
- Previdian observations
- 20 attempts from 13 attacker IP addresses in nine countries
2 sources
What people are saying
Previdian sensors have observed 20 exploitation attempts, 13 unique attacker IPs, and 9 countries targeting CVE-2026-123158. First observed Nov 06, 2026; last observed Nov 08, 2026
Posts on X
🚨 As expected, watchTowr Intel is observing exploitation of the OpenSSH Authentication Bypass “SSHole” (CVE-2026-123158). For now, it’s botnets and crypto miners. We’re interested in what happens next.
🚨During the past 24 hours, we have observed a small amount of actors targetting SSHole (CVE-2026-123158) Exploitation is not widespread yet, but is showing an early accelerating trend. Track exploit intelligence 👉https://t.co/FMlpPAiZfm