Skip to content
OriginalSign in
Image: Ars Technica

Ars TechnicaDan Goodin

Hackers exploit OpenSSH flaw to access Linux accounts without passwords

Part of the CVE-2026-123158 story · since 5 Nov

Developinglatest 7 hours ago11 articles9 outlets
5 Nov · cybersixt first8 Nov9 NovNowThis article10th of 11
  • Thu 5 Nov, 16:50 UTC. cybersixt, first report. OpenSSH flaw exploited to log into key-only Alpine accounts. Cites a CVE in CISA KEV.
  • Fri 6 Nov, 11:00 UTC. SOCRadar, its first report on the story. OpenSSH fixes password bypass affecting Alpine Linux systems. Cites a CVE in CISA KEV.
  • Fri 6 Nov, 13:00 UTC. SecurityWeek, its first report on the story. OpenSSH patches SSHole flaw that bypasses password authentication. Cites a CVE in CISA KEV.
  • Fri 6 Nov, 17:30 UTC. The Hacker News, its first report on the story. Hackers Exploit OpenSSH SSHole Flaw to Gain Root Access. Cites a CVE in CISA KEV.
  • Fri 6 Nov, 23:00 UTC. StepSecurity, its first report on the story. OpenSSH flaw lets attackers bypass password checks on Alpine Linux. Cites a CVE in CISA KEV.
  • Sun 8 Nov, 17:00 UTC. SANS ISC, its first report on the story. SANS honeypots record rising attempts to exploit Sshole. Cites a CVE in CISA KEV.
  • Mon 9 Nov, 13:00 UTC. SecurityWeek. Attackers Exploit OpenSSH Authentication Bypass in the Wild. Cites a CVE in CISA KEV.
  • Mon 9 Nov, 15:00 UTC. The Hacker News. OpenSSH flaw allows passwordless logins on musl systems. Cites a CVE in CISA KEV.
  • Mon 9 Nov, 17:01 UTC. CISA, its first report on the story. CISA adds OpenSSH authentication bypass flaw to exploited vulnerabilities list. Cites a CVE in CISA KEV.
  • Mon 9 Nov, 20:30 UTC. Ars Technica, its first report on the story. Hackers exploit OpenSSH flaw to access Linux accounts without passwords. Cites a CVE in CISA KEV. This article, 10th of 11.
  • Tue 10 Nov, 01:31 UTC. SecurityOnline, its first report on the story. CISA adds four flaws exploited in the wild to its KEV catalog. Cites a CVE in CISA KEV.

Hackers are actively exploiting a vulnerability in OpenSSH that, when run with musl and under specific configuration conditions, can grant unauthenticated access to high-privilege accounts on a wide range of Linux systems. The flaw, tracked as CVE-2026-123158, arises from the interaction between OpenSSH and the musl C library; it affects systems that also do not use PAM for authentication and have at least one passwordless account (with the password field in /etc/shadow set to “*” or similar).

Exploitation is triggered by an attacker supplying a password longer than 256 characters, which causes musl’s password-hashing function to return “*” and allows login without credentials. The issue notably threatens Alpine Linux installations, among others.

Security firms report active exploitation and “mature intrusions” linked to a group tracked as GT10. Greynoise said its honeypots in Southeast Asia have been compromised, revealing additional potential victims and tools used in the campaign, including a backdoor named TAC Agent that supports shell, reconnaissance and persistence; the group is observed installing Python3 where missing, to run the backdoor.

WatchTowr and Previdian corroborate ongoing exploitation, with Previdian noting about 20 exploitation attempts from 13 unique attacker IP addresses across nine countries. OpenSSH has issued a patch to mitigate the vulnerability, and researchers urge users of musl-based Linux systems to apply the update and review configurations for passwordless accounts and PAM usage.

How the story developed

All 11 articles
Developinglatest 7 hours ago11 articles9 outlets

11 articles from 9 outlets since 5 Nov. Still developing; the latest report was 7 hours ago. This was the 10th report, 4 days after the first.

Now5 Nov78910First reportcybersixt · 5 Nov, 16:50This article10th of 11 · day 4CISA alert9 Nov, 17:01 · official
  • Thu 5 Nov, 16:50 UTC. cybersixt, first report. OpenSSH flaw exploited to log into key-only Alpine accounts. Cites a CVE in CISA KEV.
  • Fri 6 Nov, 11:00 UTC. SOCRadar, its first report on the story. OpenSSH fixes password bypass affecting Alpine Linux systems. Cites a CVE in CISA KEV.
  • Fri 6 Nov, 13:00 UTC. SecurityWeek, its first report on the story. OpenSSH patches SSHole flaw that bypasses password authentication. Cites a CVE in CISA KEV.
  • Fri 6 Nov, 17:30 UTC. The Hacker News, its first report on the story. Hackers Exploit OpenSSH SSHole Flaw to Gain Root Access. Cites a CVE in CISA KEV.
  • Fri 6 Nov, 23:00 UTC. StepSecurity, its first report on the story. OpenSSH flaw lets attackers bypass password checks on Alpine Linux. Cites a CVE in CISA KEV.
  • Sun 8 Nov, 17:00 UTC. SANS ISC, its first report on the story. SANS honeypots record rising attempts to exploit Sshole. Cites a CVE in CISA KEV.
  • Mon 9 Nov, 13:00 UTC. SecurityWeek. Attackers Exploit OpenSSH Authentication Bypass in the Wild. Cites a CVE in CISA KEV.
  • Mon 9 Nov, 15:00 UTC. The Hacker News. OpenSSH flaw allows passwordless logins on musl systems. Cites a CVE in CISA KEV.
  • Mon 9 Nov, 17:01 UTC. CISA, its first report on the story. CISA adds OpenSSH authentication bypass flaw to exploited vulnerabilities list. Cites a CVE in CISA KEV.
  • Mon 9 Nov, 20:30 UTC. Ars Technica, its first report on the story. Hackers exploit OpenSSH flaw to access Linux accounts without passwords. Cites a CVE in CISA KEV. This article, 10th of 11.
  • Tue 10 Nov, 01:31 UTC. SecurityOnline, its first report on the story. CISA adds four flaws exploited in the wild to its KEV catalog. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
Show all 11 articles as a list
  1. Thu 5 NovDay 01
    1. OpenSSH flaw exploited to log into key-only Alpine accounts16:50 · cybersixt · First report · Exploited CVE · Known exploited CVE
  2. Fri 6 NovDay 14
    1. OpenSSH fixes password bypass affecting Alpine Linux systems11:00 · SOCRadar · Known exploited CVE
    2. OpenSSH patches SSHole flaw that bypasses password authentication13:00 · SecurityWeek · Known exploited CVE
    3. Hackers Exploit OpenSSH SSHole Flaw to Gain Root Access17:30 · The Hacker News · Known exploited CVE
    4. OpenSSH flaw lets attackers bypass password checks on Alpine Linux23:00 · StepSecurity · Known exploited CVE

  3. Quiet for 2 days

    Sun 8 NovDay 31
    1. SANS honeypots record rising attempts to exploit Sshole17:00 · SANS ISC · Known exploited CVE
  4. Mon 9 NovDay 44
    1. Attackers Exploit OpenSSH Authentication Bypass in the Wild13:00 · SecurityWeek · Known exploited CVE
    2. OpenSSH flaw allows passwordless logins on musl systems15:00 · The Hacker News · Known exploited CVE
    3. CISA adds OpenSSH authentication bypass flaw to exploited vulnerabilities list17:01 · CISA · official · CISA alert · Known exploited CVE
    4. Hackers exploit OpenSSH flaw to access Linux accounts without passwords20:30 · Ars Technica · Known exploited CVE · This article, 10th of 11
  5. Tue 10 NovDay 51
    1. CISA adds four flaws exploited in the wild to its KEV catalog01:31 · SecurityOnline · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in