Exploitation of SSHole OpenSSH auth bypass has begun, researchers say

Attackers have started exploiting SSHole, the OpenSSH authentication bypass that got patches last week. SecurityWeek reported the activity on 9 November, citing WatchTowr and Previdian.

The bug is tracked as CVE-2026-123158. It affects sshd on Linux builds that use musl libc with PAM disabled, which covers Alpine, Buildroot, OpenWrt and Yocto among others. The mechanism is a mix-up over whether a string is meant to be a password hash. When an account has no hash stored, sshd borrows a salt from another account's hash; for passwords longer than 256 bytes musl's crypt() fails and returns "", which matches the "" stored for the target account. sshd then treats the login as correct.

That matters because it reaches accounts that shouldn't take a password at all. On Alpine, SecurityWeek lists root, key-only users created with adduser without a password, the Alpine user in the official tiny-cloud images, and users coming in through musl-nscd.

Previdian says its sensors saw 20 exploitation attempts from 13 unique attacker IPs across 9 countries, first on 6 November and last on 8 November. WatchTowr says only botnets and crypto miners have picked it up so far. Nobody has published evidence of a more targeted intrusion, and the reports don't say whether any of the attempts succeeded.

The fix is OpenSSH 10.6p2. If you can't move yet, turn off password authentication (it's on by default) or stop running SSH, and read the logs for long-password login attempts. We'd check Alpine and other musl hosts for root logins before anything else.

CVE references

CVE-2026-123158