Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot

Live updates

1. 43m ago

   OpenSSH SSHole Flaw Exploited Within Hours, Root Access Gained on Honeypot

   Attackers began exploiting the OpenSSH SSHole authentication bypass, CVE-2026-123158, within nine hours of its CVE publication, according to SANS Internet Storm Center findings reported by multiple outlets. One Alpine Linux honeypot granted the attacker root access. The flaw affects OpenSSH servers on musl-based Linux systems with PAM disabled, including Alpine Linux's default configuration. An unauthenticated attacker can supply an oversized password to access accounts with no usable password, without stealing credentials or SSH keys. OpenSSH released a fix in version 10.6p2. The flaw was discovered by security researcher Ozgun Kultekin.

   Why it matters

   SSHole creates a path into accounts that administrators deliberately configured without usable passwords, making password-disabled Linux systems a direct target rather than a side effect of credential theft. The affected setup is narrow but relevant because Alpine Linux's default OpenSSH server configuration falls within it. The reported root access came from a honeypot, so it demonstrates exploitability rather than confirming compromise of production systems. The issue has been patched in OpenSSH 10.6p2.

   What is confirmed

   • CVE-2026-123158, codenamed SSHole or *sshole, carries a CVSS score of 8.1.
   • The flaw affects OpenSSH on musl-based Linux systems with Pluggable Authentication Modules disabled, including Alpine Linux's default OpenSSH server configuration.
   • An unauthenticated attacker can supply an oversized password to access accounts configured without usable passwords, without stealing credentials or SSH keys.
   • Attackers began exploiting the flaw within nine hours of its CVE publication.
   • One honeypot running Alpine Linux granted root access to the attacker.
   • Security researcher Ozgun Kultekin discovered the vulnerability.
   • OpenSSH addressed the issue in version 10.6p2.

   Still unconfirmed

   • Previdian reported that threat actors were attempting to exploit the flaw, but the excerpts do not establish the scale or number of affected real-world systems.

   What to watch next

   • Confirmation of exploitation against production systems rather than honeypots
   • Evidence showing whether the oversized-password technique works on systems beyond the musl-based, PAM-disabled configuration
   • OpenSSH 10.6p2 adoption across exposed Alpine Linux and other affected servers
   Sources used for this update (11)

   1. Ars Technica — Meet *sshole, the vulnerability that lets hackers SSH into Linux devices
   2. OX Security — OpenSSH Password Authentication Bypass on Alpine Linux (*sshole) – CVE-2026-123158
   3. The Hacker News — Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot
   4. BleepingComputer — OpenSSH flaw lets attackers log into password-disabled Linux accounts
   5. SecurityWeek — OpenSSH Rushes Patches for ‘SSHole’ Authentication Bypass
   6. thehackernews.com — Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure ...
   7. securityarsenal.com — CVE-2026-123158 (SSHole): OpenSSH Empty-Password Login Flaw ...
   8. news.lavx.hu — Hackers exploit OpenSSH 'SSHole' flaw hours after disclosure ...
   9. cybersecuritynews.com — Hackers Begin Exploiting OpenSSH SSHole Authentication Bypass ...
   10. www.domainaftercare.com — Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure ...
   11. hackerfeeds.com — Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure ...
   confidence 88%