Attackers Exploit SSHole OpenSSH Flaw That Bypasses Password Checks
Systems running OpenSSH with musl and without PAM are most exposed, and administrators should upgrade to 10.6p2 or disable password logins now.
A recently patched OpenSSH flaw, tracked as CVE-2026-123158 and nicknamed SSHole, is now being exploited in the wild, and the risk is greatest for systems running OpenSSH alongside the musl C library without PAM. The bug lets anyone log in to accounts that should reject passwords, such as root on Alpine, by submitting an oversized password that musl's hashing routine mishandles. Exploitation began on November 5, the day a proof-of-concept appeared, and GreyNoise recorded its first successful attack on November 7, about 40 hours after the fix in OpenSSH 10.6p2. Observed campaigns range from botnets and cryptominers to a group GreyNoise tracks as GT10, which ran reconnaissance, tried to read password hashes and root SSH keys, and planted a Python command-and-control agent for persistence. Administrators should upgrade to OpenSSH 10.6p2 or disable password authentication, and check for unexpected password logins on accounts whose shadow field is an asterisk, unauthorized authorized_keys entries, and unfamiliar startup services.
Why it matters
The flaw lets an attacker log in to accounts that should refuse passwords, including root on Alpine, by sending an oversized password. Attacks observed so far range from botnets and cryptominers to a group doing reconnaissance and installing persistent command-and-control software. Because exploitation started within about two days of the fix, the window for systems left unpatched is short. Anyone responsible for Linux servers that use this combination should treat unexplained password logins as a possible compromise.
Series OpenSSH flaw on musl
- Attackers Exploit SSHole OpenSSH Flaw That Bypasses Password Checks
- Long password strings can give attackers root on some musl-based Linux SSH servers
- OpenSSH flaw on musl systems lets attackers into password-locked Linux accounts
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.