CybersecurityHackers exploit SSHole OpenSSH vulnerability to breach Linux systems
Threat actors are actively exploiting the CVE-2026-123158 authentication bypass in OpenSSH to compromise Alpine Linux systems following the release of version 10.6p2.
CybersecurityIn brief: Threat actors began exploiting the SSHole OpenSSH vulnerability (CVE-2026-123158), rated 8.1 on CVSS 3.1, after OpenSSH released version 10.6p2 on 5 November 2026. Attackers bypassed password authentication on musl-based Linux systems such as Alpine Linux to gain root access, run reconnaissance and deploy a Python command-and-control implant.
Threat actors are actively exploiting the SSHole OpenSSH vulnerability, tracked as CVE-2026-123158, to breach Linux systems, steal credentials, execute commands and establish persistent access. Multiple cybersecurity firms confirmed that attack attempts began on 5 November 2026, the same day OpenSSH released version 10.6p2 to fix the flaw. Proof-of-concept exploit code appeared roughly four hours after the patch, and defenders recorded successful intrusions the following day.
How the authentication bypass works
Security researcher Özgün Kültekin of Wakefield disclosed the flaw, which MITRE rates 8.1 (High) on the CVSS 3.1 scale. The bug affects OpenSSH compiled against the musl C library without PAM, which is the default openssh-server package on Alpine Linux. An attacker who can reach the SSH port can send an oversized password to log in to an account that has no password. The oversized input causes the musl password-hashing function to return an asterisk on error. OpenSSH then mistakenly matches that asterisk against accounts whose stored hash is set to an asterisk to block password logins.
Kültekin said exploitation requires specific authentication settings and spares accounts with valid password hashes. Cycode reported that exposure requires an SSH server running without PAM, default password logins enabled, a passwordless account and another account with a stored hash. Exposed accounts include key-only users or the alpine user on official Alpine cloud images 3.18.11 to 3.24.3, which can run doas as root. The root account stays protected by PermitRootLogin prohibit-password, and glibc systems including Debian, Ubuntu and Fedora are unaffected. Cycode tested public Docker Hub images in a local lab and found a small number exposed under their documented setup. Widely used images including Gitea, Gogs, the Jenkins SSH agent and linuxserver openssh-server disable password logins unless PASSWORD_ACCESS=true is set.
Active exploitation and post-compromise activity
Offensive security firm watchTower said on 6 November that it observed SSHole exploitation in attacks linked to botnets and cryptomining activity. Finnish security company Defused said over the weekend that it observed "a small amount of actors" targeting the bug, though activity was not widespread. Sensors from network security company Previdian also confirmed successful exploitation, recording 20 attempts from 13 attacker IP addresses across nine countries.
Threat intelligence company GreyNoise recorded its first successful intrusion in the wild on 7 November at 00:46 UTC, roughly 40 hours after the fix. Researchers logged 16 successful exploitation chains from six source IP addresses against GreyNoise-protected networks, alongside 27.5 million port-22 scans and 20.1 million attempted SSH sessions overall. In the confirmed attacks, threat actors ran system and container reconnaissance, queried cloud metadata services, and tried to read password hashes and root SSH keys. They also attempted to modify SSH authorized_keys files to gain persistent access.
One attacker gained root privileges and installed TAC Agent, a Python command-and-control (C2) agent. The implant could not reach its C2 server at tac.vpnla[.]org and never received a task. Analysis shows the payload supports shell command execution, system reconnaissance, file uploads and downloads, and self-updates, while attackers configure a startup service for persistence. GreyNoise said the implant had Chinese comments, logs and errors, alongside a missing tool check that returns feedback for an automated planner.
What happens next
OpenSSH maintainers released the version 10.6p2 patch within a day of Kültekin's report and committed to shipping future fixes as soon as they are ready. The maintainers said they now skip long embargoes because artificial intelligence (AI) tools rediscover reported bugs, sometimes within hours. Alpine Linux published fixed openssh packages on 5 November and backported the fix to every branch from 3.16 to edge. Images on Alpine releases before 3.16 receive no fixed package and remain exploitable unless reconfigured.
System administrators should run apk upgrade, restart the SSH daemon, and rebuild and redeploy container images that carry older openssh packages. Where upgrading is not possible, administrators must set PasswordAuthentication no after verifying that key logins work. Defenders should also search /var/log/messages for accepted password logins on passwordless accounts and treat any matching system as compromised. Administrators are advised to check for unexpected logins to asterisk accounts and inspect hosts for unauthorised SSH keys, TAC Agent files and startup services.
Sources: BleepingComputer, SecurityWeek, Cycode
Fact-checked against the linked sources before publication. Spotted an error? See our Corrections Policy.
Spotted an error? Email corrections@itmagazineme.com with the article link.
