Vulnerabilities
Hackers exploit OpenSSH 'SSHole' flaw to bypass authentication
Attackers are exploiting a bug in OpenSSH that lets them log in to some Linux systems as root or other users, even without knowing a password. The flaw mainly affects Alpine and similar distributions.
Ross GrantUpdated 2 min read
The short version
A bug in OpenSSH lets attackers log in as root or other users on some Linux systems, even if they do not know the password. This mainly affects Alpine Linux and similar systems. The problem happens when a very long password is used. Patches are available, and users should update quickly.
By the numbers
- 20exploitation attempts observed by Previdian sensorsSecurityWeek
- 13unique attacker IPs seen targeting the flawSecurityWeek
- 9countries where attacks originatedSecurityWeek
What happened?
Hackers are exploiting a newly patched authentication bypass bug in OpenSSH, known as 'SSHole' (CVE-2026-123158). The flaw lets attackers log in to some Linux systems as root or other users by submitting an unusually long password. Only Alpine and similar distributions are affected. Security firms have seen active exploitation attempts since early November 2026.
How the flaw works
A new vulnerability in OpenSSH, called 'SSHole' and tracked as CVE-2026-123158, allows attackers to bypass password authentication on certain Linux systems. The bug is linked to how OpenSSH checks passwords when the Pluggable Authentication Module (PAM) is disabled, which is common on distributions like Alpine, Buildroot, OpenWrt, and Yocto.
Normally, accounts like 'root' should never accept a password login. But on these systems, if an account has no password hash (the field is just ''), OpenSSH borrows a salt value from another account to process the login. If an attacker submits a password between 257 and 1024 characters, a function in musl libc (the cryptographic library used by these systems) fails in a way that returns ''. This matches the stored value, so OpenSSH treats the login as successful, even though the password is not valid.
Who is affected
The flaw mainly affects Linux distributions that use musl libc and have PAM disabled. Alpine Linux is the most widely used example. Accounts at risk include 'root', users created without a password, the Alpine user in official cloud images, and users from directory services using musl-nscd.
The response
OpenSSH released a patch for this vulnerability last week. Alpine Linux has urged users to update and restart their SSH servers immediately. Security firms WatchTowr and Previdian reported that hackers began exploiting the flaw soon after the patch was released. Previdian sensors saw 20 exploitation attempts from 13 unique IP addresses across 9 countries between 6 and 8 November 2026. Other security companies, including GreyNoise and Defused, have also observed attacks.
What you should do
Users should update to OpenSSH version 10.6p2 or later as soon as possible. As a temporary fix, disabling password authentication (which is on by default) or disabling SSH entirely can block the attack. It is also important to check server logs for unusual login attempts, especially those using very long passwords, to spot signs of exploitation.
Why it matters
This bug lets attackers gain full control of affected systems without knowing any passwords. Servers running Alpine Linux or similar distributions are at risk until patched. Attackers are already trying to exploit the flaw.
Key points
- A bug in OpenSSH lets attackers bypass authentication on some Linux systems.
- The issue affects Alpine, Buildroot, OpenWrt, Yocto and similar distributions.
- Attackers can log in as root by submitting a long password.
- A patch is available; updating OpenSSH fixes the problem.
- Several security firms have seen active exploitation attempts.
Sources
SecurityWeek
Reference
