Attackers began exploiting an OpenSSH flaw affecting musl-based Linux such as Alpine within hours of disclosure. OpenSSH 10.6p2 fixes it.
A newly disclosed OpenSSH vulnerability nicknamed "SSHole" (CVE-2026-123158, CVSS 8.1) is already being exploited. The Hacker News reported on 6 November 2026 that the first exploitation attempt was seen less than nine hours after the CVE was published.
The flaw affects Linux systems that run OpenSSH on the musl C library with PAM disabled. This includes the default OpenSSH server setup on Alpine Linux, which is widely used in containers and small appliances. Systems based on glibc, systems that check passwords through PAM, non-Linux systems and the Dropbear SSH server are not affected, according to the report.
How it works
On affected systems, an attacker without credentials can send a very long password (between 257 and 1,024 bytes). The password hashing step fails, and because of logic added in 2016 to prevent username enumeration, the failure produces the same value that marks an account with a disabled password. The login is then accepted. The attack only works against accounts whose password is disabled in this way, such as key-only accounts, and gives the attacker that account's permissions.
Security firm Previdian reported that it confirmed root access on an Alpine Linux honeypot, with eight attempts from a single IP address. The flaw is fixed in OpenSSH 10.6p2.
This article summarizes and comments on the source above in our own words. NC Solution is not affiliated with the source; read the original for full details.