OpenSSH SSHole Flaw Exploited Within Hours on Alpine

The OpenSSH SSHole flaw, tracked as CVE-2026-123158, is already under attack. Threat intelligence firm Previdian saw the first exploitation attempt less than nine hours after the CVE went public. It also confirmed root access on an Alpine Linux honeypot. The bug scores 8.1 (High) on CVSS, and a fix is out in OpenSSH 10.6p2.

The exploitation report so far comes from one security firm’s honeypot. Check back as vendors confirm more.

Who does the OpenSSH SSHole flaw affect?

Linux systems running OpenSSH on the musl C library with PAM disabled are affected. That includes Alpine Linux’s default openssh-server setup.

Several things are not affected:

• glibc-based Linux distributions
• Dropbear
• Non-Linux systems
• Setups that check passwords through PAM

An attack needs more than a reachable server. The target account’s password field must hold *, which marks a passwordless account. Another local account must carry a $5$ or $6$ password hash. Password authentication must also be switched on.

How does the SSHole bug work?

The root cause traces back to a 2016 patch for username enumeration (CVE-2016-6210). Under certain conditions, a failed password-hashing step returns *. That is the same value used for accounts with no password. sshd sees the match and lets the login through.

An unauthenticated attacker triggers this by sending a password between 257 and 1,024 bytes long. The attacker then inherits that account’s permissions.

On official Alpine tiny-cloud images from 3.18.11 through 3.24.3, the alpine account has passwordless doas access. Once a qualifying hash exists, that means root.

Researcher Özgün Kültekin found the flaw and published the analysis.

What did attackers do on the honeypot?

Previdian logged eight attempts from a single IP address in Japan. The attacker ran basic reconnaissance commands: id, uname and hostname, through non-interactive SSH sessions.

That looks like probing, not a full intrusion. It still shows how fast attackers move on a fresh CVE.

What should you do now?

Update first. Install OpenSSH 10.6p2 or your distribution’s patched package, then restart sshd. On Alpine, run apk upgrade -U -a, then rc-service sshd restart. Upgrading without a restart leaves the old daemon running.

Alpine’s fixed releases are 3.21.10, 3.22.8, 3.23.8 and 3.24.4. Older branches also have patched packages. A lower OpenSSH version number alone does not mean you are vulnerable.

If you cannot patch yet, set PasswordAuthentication no. Confirm key-based login works, then restart sshd. Keep an existing session open while you test.

Then check for signs of abuse:

• Search /var/log/messages for Accepted password for entries on accounts that should not accept passwords.
• Review doas usage, recently created users and authorized_keys files.
• Treat the machine as compromised if you cannot rule out a login.

Why this matters

The OpenSSH SSHole flaw hits a narrow set of setups, but those setups include popular container and cloud images. Attackers are not waiting for patch cycles. The same pattern showed up this week in our report on the WordPress core flaw exploited in the wild. Patch the exposed servers first.

Sources: The Hacker News, Cyber Security News