Attackers are exploiting a critical OpenSSH authentication bypass known as SSHole, targeting certain Linux systems built with musl libc and configured without Pluggable Authentication Modules. The flaw is tracked as CVE-2026-123158 and was fixed in OpenSSH 10.6p2.
The vulnerability can let an unauthenticated remote attacker bypass password authentication by submitting an overlong password. The affected configuration is common in lightweight distributions and embedded environments, including Alpine Linux, OpenWrt, Yocto and Buildroot. Red Hat said its products are not affected because they use glibc rather than musl.
SANS Internet Storm Center observed exploit attempts beginning November 5, while GreyNoise later reported successful chains that performed reconnaissance, queried cloud metadata, read sensitive files and added SSH keys. Early activity has included botnet and cryptocurrency-mining behavior.
The issue is especially dangerous because SSH is often exposed for routine administration and may sit on appliances that receive less attention than general-purpose servers.
Bri Frost, director of product management at Cloud Range, said: “SSH is a routine part of how organizations manage systems. That makes SSHole more than a patching task.” She added that teams should check for prior compromise and practice containment, not just install the fix.
Defenders should identify internet-facing SSH services, determine which use musl without PAM, upgrade to OpenSSH 10.6p2 or a vendor-fixed package, and review authorized_keys, authentication logs, new accounts and outbound connections.
