Attackers Exploit SSHole OpenSSH Flaw in Linux Systems
Summary
Multiple firms report active exploitation of OpenSSH flaw CVE-2026-123158 on certain musl-based Linux systems. Attackers can bypass authentication under specific conditions; OpenSSH 10.6p2 fixes the flaw.
Key points
- SSHole affects OpenSSH on certain musl-based Linux systems, including Alpine. An oversized password can cause musl’s hashing function to return *, which OpenSSH may incorrectly accept as a match.
- Exploitation requires specific authentication settings and an account with a stored password hash of *. Root access may be possible if that account has passwordless administrative privileges.
- Firms reported exploitation attempts beginning November 5, 2026. GreyNoise recorded its first successful in-the-wild exploitation on November 7.
- GreyNoise observed 16 successful exploitation chains from six source IP addresses, but said its observations do not represent broader SSHole activity.
- In one observed attack, an intruder gained root privileges and installed the TAC Agent. Its C2 server at tac.vpnla[.]org was unreachable, and the agent received no task.
- OpenSSH 10.6p2 fixes the vulnerability. Administrators are advised to update or disable SSH password authentication on affected systems and check for unexpected logins, SSH keys, TAC Agent files, or startup services.
Article Details
- Vulnerability Types
- Authentication bypass
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- Disable SSH password authentication on systems affected by SSHole.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | tac[.]vpnla[.]org | C2 domain configured for TAC Agent; the observed implant could not reach it. |
MITRE ATT&CK
T1003.008 · /etc/passwd and /etc/shadowThe observed attacker attempted to read password hashes.T1059.004 · Unix ShellThe TAC Agent supports shell command execution, and the observed attacker ran system commands.T1082 · System Information DiscoveryThe observed attacker performed system reconnaissance.T1098.004 · SSH Authorized KeysThe observed attacker attempted to modify SSH authorized_keys files for persistent access.T1190 · Exploit Public-Facing ApplicationAttackers exploited the SSHole flaw in OpenSSH to gain access to Linux systems.T1552.004 · Private KeysThe observed attacker attempted to read root SSH keys.T1552.005 · Cloud Instance Metadata APIThe observed attacker queried cloud metadata services.T1613 · Container and Resource DiscoveryThe observed attacker performed container reconnaissance.
CVE
People
Malware
Vendors
DefusedFinnish security company Defused said over the weekend that it had observed "a small amount of actors" trying to exploit SSHole, although the activity was not widespread.GreyNoiseThreat intelligence company GreyNoise recorded the first successful exploitation of SSHole in the wild on November 7 at 00:46 UTC, approximately 40 hours after the fix.PrevidianSensors from network security company Previdian also confirmed successful SSHole exploitation, with telemetry data showing 20 attempts from 13 attacker IP addresses in nine countries.watchTowerOffensive security firm watchTower said on November 6 that it observed SSHole being exploited in attacks associated with botnets and cryptomining activity.