OpenSSH SSHole flaw draws exploit attempts within hours of disclosure

Attackers started trying to exploit a freshly disclosed OpenSSH flaw within hours of it becoming public, according to Previdian, which The Hacker News reported on Nov 06, 2026. The write-up says one honeypot was rooted.

The bug is tracked as CVE-2026-123158, scored 8.1, and nicknamed SSHole. It affects Linux systems running OpenSSH on the musl C library with PAM disabled. In that setup, sshd lacks a workaround for a password authentication bypass that comes down to misreading whether a string is meant to be a password hash. For some account configurations, any password between 256 and 1024 characters is accepted. Alpine Linux is one platform that fits the description.

The advisory's affected range runs up to, but not including, 10.6p2, and the OpenSSH release notes for 10.6p2 are among the references. The CVE record doesn't state a patch status beyond that.

So the exposure is narrower than "OpenSSH is broken". Most distributions build with PAM, and glibc systems aren't in scope. The people who should look first are those running musl-based images, containers especially, with PAM off.

What's still missing: Previdian's account of the honeypot doesn't say how many hosts were hit or who was behind the attempts, and we haven't seen a second source confirm the root access. Two reproduction repositories are linked from the CVE record, so expect more scanning. We'd check the libc and PAM configuration on any musl host before reading the rest of the news.

CVE references

CVE-2026-123158