Attackers Exploit OpenSSH Authentication Bypass in the Wild

Threat actors are actively exploiting SSHole, a high-severity authentication bypass in OpenSSH tracked as CVE-2026-123158. Research indicates the flaw relates to how sshd interprets whether a string is intended to be a password hash. If an account has no password hash (for example, root on Alpine), sshd may treat an abnormally long password as valid due to how musl’s crypt() handles hashes longer than 256 bytes. This can allow attackers to gain access by supplying any password between 257 and 1024 characters.

Alpine, Buildroot, OpenWrt, Yocto and similar systems using musl with PAM disabled are specifically affected, as these configurations may accept a password under certain conditions.

Over the weekend, security firms and researchers reported in-the-wild exploitation attempts, with initial activity attributed to botnets and crypto miners. Previdian sensors noted 20 exploitation attempts from 13 unique attacker IPs across 9 countries, first seen on 6 November 2026 and last observed on 8 November 2026. GreyNoise and Defuded Cyber also reported exploitation activity. OpenSSH rushed patches to version 10.6p2, and Alpine urged immediate update and restarting sshd.

As mitigation, organisations are advised to disable password authentication (OpenSSH defaults to on) or disable SSH entirely, and to scan logs for unusual login requests to identify exploitation attempts.