OpenSSH “SSHole” flaw exploited within hours of disclosure

Threat actors began exploiting CVE-2026-123158, dubbed SSHole, within hours of its public disclosure, even obtaining root privileges on a honeypot monitored by Previdian. The vulnerability allows remote access to certain accounts that administrators believed could not be accessed using passwords and has a CVSS score of 8.1. Linux systems based on the musl library are affected, including Alpine Linux, OpenWrt, and Buildroot, when OpenSSH is configured with password authentication enabled, PAM disabled, and specific hash settings. According to the advisory, an attacker able to reach the SSH port can authenticate with a single connection and without knowing a password, while common glibc-based distributions such as Ubuntu and Debian are not affected by this specific flaw. OpenSSH 10.6p2 fixed the issue, making it a priority to update, review exposed configurations, and analyze logs to identify anomalous access.

Source: The Hacker News