A niche OpenSSH bug went from advisory to live exploitation in less than a workday.
On November 6, 2026, The Hacker News reported that threat actors are trying to exploit CVE-2026-123158 (CVSS 8.1), codenamed SSHole, which can allow sign-ins to accounts that have no password set. The issue affects Linux systems running OpenSSH on the musl C library with PAM disabled — including Alpine Linux’s default OpenSSH configuration. It is fixed in OpenSSH 10.6p2. Researcher Ozgun Kultekin discovered the flaw.
How SSHole works
An unauthenticated attacker can supply an oversized password — between 257 and 1,024 bytes — to access accounts deliberately configured without usable passwords. The bug traces to a 2016 username-enumeration fix (CVE-2016-6210): under specific conditions, a failed password-hashing operation returns the same asterisk value used for password-disabled accounts, so sshd treats the login as successful. Exploitation requires at least one account with “*” as its password hash; it does not bypass real password hashes. Dropbear, glibc-based distros, non-Linux systems and PAM-checking setups are not affected.
Speed of exploitation
Threat intelligence firm Previdian saw the first exploitation attempt less than nine hours after CVE publication and confirmed successful root access on an Alpine/OpenSSH honeypot. Telemetry showed eight attempts from an IP geolocated to Japan (89.116.89.18), using oversized passwords and running id, uname and hostname via non-interactive SSH.
Alpine advises checking logs for “Accepted password for” on accounts that should not accept passwords, reviewing doas use and recently created users, files and authorized keys, and treating machines as compromised if a login cannot be ruled out.
Why it matters
Container and edge fleets that default to Alpine SSH just got a patch-or-investigate clock. DevOps and cloud security vendors should lead with musl/OpenSSH exposure scans and honeypot-proven urgency.
B2B marketers selling vulnerability management or container security can use SSHole as a precise mid-market hook: Alpine defaults, nine-hour exploit lag and clear remediation steps.
Source: The Hacker News. Written by the xRapid Media LLP team.
About xRapid Media
xRapid Media LLP is a High Tech B2B Marketing company for technology businesses: software and SaaS companies, IT services and managed service providers, and hardware and IT product vendors. Our team combines positioning and content, account-based marketing, paid ads funnels, verified B2B data, intent signals, email and LinkedIn outreach and appointment setting to help you reach the right buyers and turn their attention into qualified leads and meetings.
Want help putting ideas like these into practice? Email [email protected] or book a time with our team.