CVE-2026-123158 — codenamed SSHole — was observed under active attack less than nine hours after public disclosure, according to telemetry gathered by threat intelligence firm Previdian.
How SSHole (CVE-2026-123158) allows logins with no password
The bug stems from OpenSSH password-handling logic and a 2016 patch related to CVE-2016-6210. Under a narrow set of conditions the server-side password-hash routine can fail in a way that produces the same literal asterisk ("*") value used to mark accounts that have no usable password at the system level. An attacker supplying an oversized password — between 257 and 1,024 bytes long — can trigger the failed hash, causing sshd to compare the produced "*" to the account's stored "*" hash and grant authentication.
The vulnerability only enables access to accounts that already have an asterisk as the password hash; it does not bypass valid password hashes or allow attackers to authenticate to accounts with ordinary password entries.
Which systems are affected — and which are not
CVE-2026-123158 impacts Linux systems running OpenSSH built against the musl C library with Pluggable Authentication Modules (PAM) disabled. The advisory explicitly calls out Alpine Linux's default OpenSSH server configuration as falling into this category. The vulnerability does not affect Dropbear, glibc-based Linux distributions, non-Linux systems, or systems that check passwords via PAM.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageObserved exploitation: Previdian's honeypot and telemetry
Previdian reported the first exploitation attempt less than nine hours after the CVE publication and confirmed successful root access on a honeypot running Alpine Linux and OpenSSH. Telemetry showed a total of eight exploitation attempts originating from an IP address geolocated to Japan. Previdian identified the observed source as 89.116.89[.]18.
In a statement shared with The Hacker News, Ryan Dewhurst, founder and CEO of Previdian, said the source IP "used oversized passwords to bypass authentication and ran reconnaissance commands including id, uname and hostname through non-interactive SSH sessions."
Mitigation: the patch, detection, and immediate actions
OpenSSH maintainers published a fix in OpenSSH 10.6p2. Affected users are advised to install OpenSSH 10.6p2 or their distribution's patched package and then restart sshd.
Alpine Linux also issued guidance for detection and response: "Look in /var/log/messages for sshd lines reading Accepted password for an account that has no password (alpine, root, or any key-only user)," Alpine said, advising administrators to "Review doas use and recently created users, files and authorized keys on exposed machines. If you cannot rule out a login, treat the machine as compromised."
What this means for technologists, enterprises, and end users
- Technologists and security teams: implement OpenSSH 10.6p2 or your distribution's patch and restart sshd; review /var/log/messages for "Accepted password for" entries on accounts that should not accept passwords, and investigate any matches.
- Enterprises and procurement leaders: understand that "A successful SSHole attack grants access with the compromised account's existing permissions," per Safe Security, and that post-compromise activity may expose deployment credentials, application secrets, and connected infrastructure enabling lateral movement or service disruption.
- End users and administrators of exposed systems: if you cannot rule out a login by the methods above, follow Alpine's advice and treat the machine as compromised — review recently created users, doas use, files and authorized keys, and proceed with incident response.
Security vendor Safe Security summarized the operational stakes: "For enterprise, the consequences of SSHole depend on the privileges of the compromised account." While the immediate impact is unauthorized SSH access, Safe Security warned attackers may leverage that access to harvest credentials and move laterally.
The technical remedy is clear and immediate: install OpenSSH 10.6p2 or a distribution patch and restart sshd. The operational work that follows — log review, credential and key inspection, and treating uncertain compromises as real incidents — is equally concrete and urgent. Previdian's confirmed root compromise on an Alpine honeypot and the rapid exploitation attempts underscore that remediation and retrospective detection cannot wait.
Original reporting: The Hacker News — Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot
