SSHole OpenSSH Authentication Bypass Exploited in the Wild
Summary
Threat actors are reportedly exploiting SSHole (CVE-2026-123158), an OpenSSH authentication bypass affecting certain musl-based systems with PAM disabled. OpenSSH 10.6p2 patches the flaw; disabling password authentication is a mitigation.
Key points
- The flaw can allow authentication using passwords 257–1,024 characters long on certain systems.
- It affects configurations using musl libc with PAM disabled, including some Alpine, Buildroot, OpenWrt, and Yocto systems.
- For passwordless accounts, musl’s crypt() may return “*” on long inputs, which can match the stored value and cause sshd to accept the password.
- WatchTowr and Previdian reported in-the-wild exploitation; WatchTowr said observed activity so far involved botnets and crypto miners.
- Previdian reported 20 exploitation attempts from 13 unique attacker IPs across nine countries between Nov. 6 and Nov. 8, 2026.
- Users are advised to update to OpenSSH 10.6p2, disable password authentication or SSH as a mitigation, and check logs for unusual requests.
Article Details
- Vulnerability Types
- Authentication bypass
- Severity
- High
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Disable password authentication.
- Disable SSH.
CVE
Products
Alpine LinuxOn certain Linux distributions that use the musl libc implementation with the Pluggable Authentication Module (PAM) disabled, such as Alpine, Buildroot, OpenWrt, Yocto, and others, these accounts do accept a password.OpenSSHThreat actors have started exploiting SSHole, a recently patched high-severity authentication bypass vulnerability in OpenSSH.