Hackers Exploit OpenSSH SSHole Flaw to Gain Root Access

Threat actors moved quickly to exploit a newly disclosed OpenSSH flaw, with Previdian reporting exploitation attempts within hours of the CVE publication. The issue, tracked as CVE-2026-123158 and nicknamed SSHole, affects OpenSSH on musl-based Linux distributions when PAM is disabled, including Alpine Linux’s default OpenSSH server configuration.

An unauthenticated attacker can authenticate to accounts that are intentionally configured without usable passwords by sending an oversized password, enabling sign-in without credentials or SSH keys. OpenSSH 10.6p2 contains the fix.

The vulnerability stems from a 2016 patch addressing a username enumeration issue (CVE-2016-6210). Under certain conditions, a failed password-hashing operation can be mistaken for a legitimate password check, causing the system to treat a disabled-password account as if it had a valid password. An attacker can trigger the flaw by providing a password between 257 and 1,024 bytes long; the SSH daemon compares the resulting hash with the asterisk (*) used for disabled-password accounts, and a match permits login.

Exploitation is contingent on at least one account having an asterisk as its password hash, and does not let attackers bypass valid password hashes.

Telemetric data from Previdian indicates eight exploitation attempts from a single IP geolocated to Japan, with the first confirmed root access on a honeypot running Alpine Linux and OpenSSH. The vulnerability does not affect Dropbear, glibc-based Linux distributions, non‑Linux systems, or setups that enforce PAM-based password checks. Alpine advises restarting sshd after patching and reviewing logs for “Accepted password for” entries on accounts that should not accept password logins. Users should deploy OpenSSH 10.6p2 or patched packages and verify accounts and credentials accordingly.