Cybersecurity researchers have reported exploitation attempts targeting a recently disclosed vulnerability in OpenSSH that could allow attackers to access certain accounts without knowing their passwords. The flaw, identified as CVE-2026-123158 and nicknamed SSHole, carries a CVSS severity score of 8.1 and affects specific Linux systems running OpenSSH with the musl C library and without Pluggable Authentication Modules (PAM). Alpine Linux is among the affected environments because its default OpenSSH server configuration uses this combination. The vulnerability allows an unauthenticated attacker to submit an unusually long password and potentially gain access to an account that has no usable password configured. The issue was discovered by security researcher Özgün Kültekin and has been addressed in OpenSSH version 10.6p2. According to the OpenSSH release notes, the update includes a security fix for a password authentication bypass affecting certain Linux systems when PAM support is disabled. The vulnerability is connected to password-handling behaviour introduced through a 2016 change intended to address a username enumeration issue. Under particular conditions, OpenSSH could incorrectly interpret a failed password-hashing operation as a valid match when checking accounts whose password field contains an asterisk, a value commonly used for accounts without password-based authentication. This behaviour creates an opportunity for remote attackers to bypass the expected password check on systems that meet the required conditions.
The attack involves submitting a password between 257 and 1,024 characters long, causing the password-hashing process to fail in a way that can produce the same asterisk value stored for an account without a usable password. Under the affected configuration, the authentication process may interpret this result as a match and allow access. However, the vulnerability does not provide a universal password bypass for all OpenSSH accounts. Successful exploitation depends on specific account and system conditions, including the presence of an account with an asterisk in its password field and another account with a compatible password hash. Accounts protected by valid password hashes are not automatically exposed through this issue. According to security firm Safe Security, an attacker who successfully gains access receives the permissions already assigned to the compromised account. Depending on those privileges, unauthorized access could expose deployment credentials, application secrets and connected infrastructure, potentially creating opportunities for further movement within an organization’s environment or disruption of services. The vulnerability does not affect systems using the Dropbear SSH server, glibc-based Linux distributions, non-Linux operating systems or configurations that use PAM for password authentication. These limitations are important for administrators assessing their exposure, as the presence of OpenSSH alone does not mean a system is vulnerable. Organizations should first determine which C library and authentication configuration their systems use before deciding whether they require immediate remediation.
Threat intelligence firm Previdian reported observing exploitation attempts less than nine hours after the vulnerability was publicly disclosed. The company said its monitoring systems recorded eight attempts originating from a single IP address geolocated to Japan. Previdian also reported confirming successful root-level access on a honeypot running Alpine Linux and OpenSSH, demonstrating that the vulnerability could be used to gain access under the affected conditions. According to Ryan Dewhurst, founder and CEO of Previdian, the observed source address used oversized passwords during the attempts and subsequently ran basic system reconnaissance commands to identify information about the compromised environment. These activities included checking the account identity, operating system details and hostname through non-interactive SSH sessions. The reported activity indicates that attackers began testing the vulnerability shortly after its disclosure, although the available telemetry does not establish widespread compromise across organizations or identify specific business victims. The honeypot result demonstrates successful exploitation in a controlled monitoring environment, while the eight recorded attempts represent activity observed by Previdian sensors rather than a confirmed count of affected production systems. The findings underline the importance of timely vulnerability management, particularly for internet-facing systems that rely on SSH for remote administration. Administrators should also review authentication records for unexpected successful password logins involving accounts that are normally configured for key-based access only. Alpine Linux has specifically advised users to investigate relevant SSH log entries and review recent account activity, privilege escalation through its administrative tools, newly created files and authorized SSH keys if suspicious access is identified.
OpenSSH users running affected configurations are advised to upgrade to version 10.6p2 or install the security update provided by their Linux distribution, followed by a restart of the SSH service to ensure the patched version is running. Alpine Linux has also released updated packages for its supported branches, including versions 3.21.10, 3.22.8, 3.23.8 and 3.24.4, which include the relevant security fix. Where an immediate update is not possible, administrators can reduce exposure by disabling password-based SSH authentication, provided they have verified that their alternative access method, such as SSH key authentication, is working correctly. The Alpine Linux security advisory recommends checking system logs for successful password logins involving accounts that should not accept password authentication. It also advises reviewing administrative activity and recently created users, files and authorized keys. If administrators cannot establish whether an unauthorized login occurred, Alpine recommends treating the system as potentially compromised and conducting a wider investigation. Organizations should prioritize internet-facing systems, verify their OpenSSH build and authentication settings, apply the appropriate distribution updates and confirm that the SSH service has restarted successfully. The incident highlights how a flaw in a specific combination of software and system configuration can create security exposure even when accounts are deliberately configured without password-based access. While the reported activity makes timely patching important, the available findings do not indicate that all Linux systems or all OpenSSH deployments are affected.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
