A high-severity authentication bypass vulnerability in OpenSSH, colloquially dubbed SSHole and tracked as CVE-2026-123158, is currently being exploited in the wild. The flaw affects systems running OpenSSH that utilize the musl libc library with the Pluggable Authentication Module (PAM) disabled. Security researchers and threat intelligence firms have confirmed that exploitation attempts began as early as November 6, 2026, with activity observed through at least November 8.
The vulnerability stems from an error in how the OpenSSH server (sshd) processes password hashes. When a user account lacks a password—represented in some configurations by an asterisk—the system attempts to validate login credentials by borrowing a salt from another account’s hash. Due to a specific failure in the musl crypt() function, password strings between 257 and 1024 characters are incorrectly processed and return an asterisk. Because this result matches the asterisk stored for accounts without passwords, the system mistakenly authenticates the attacker.
This issue specifically impacts Linux distributions that rely on musl libc, including Alpine, Buildroot, OpenWrt, and Yocto. Vulnerable accounts include the root user, users created without passwords via adduser, accounts within official tiny-cloud images, and users managed through musl-nscd. While root accounts are typically configured to reject password-based logins, this vulnerability bypasses such restrictions on affected distributions.
Multiple security organizations have reported active exploitation of the flaw. Data collected by sensors indicates that dozens of unique attempts have originated from various countries. Current analysis suggests that the primary actors leveraging this vulnerability are botnets and cryptocurrency miners. While these groups are the only ones confirmed to be utilizing the exploit at this time, security experts anticipate that more sophisticated threat actors may adopt the technique as awareness of the vulnerability spreads.
In response to the discovery, the OpenSSH development team released emergency patches to address the flaw. Users are strongly advised to upgrade their systems to OpenSSH version 10.6p2 immediately. Once the update is applied, administrators must restart the sshd service to ensure the patch takes effect and to terminate any potentially compromised sessions.
For organizations unable to update immediately, several mitigations are available. Disabling password authentication—which is enabled by default in OpenSSH—effectively blocks the attack vector. Alternatively, disabling the SSH service entirely on exposed systems provides a temporary safeguard. Administrators are also encouraged to review system logs for unusual or suspicious authentication requests that may indicate an attempted breach.
The vulnerability was identified and disclosed last week, prompting rapid coordination among maintainers of the affected distributions. Alpine, in particular, has issued an urgent advisory urging its user base to prioritize the patch. The widespread nature of the distributions affected, combined with the relative simplicity of the exploit, has made this a high-priority issue for infrastructure security teams.
As of now, the situation remains fluid. While current evidence points to automated, opportunistic exploitation by botnets, the potential for unauthorized access to root-level accounts makes this a critical security concern. Organizations should treat the application of the 10.6p2 patch as a mandatory step to secure their environments against further unauthorized access attempts.
