Hackers have begun exploiting a newly disclosed high-severity vulnerability in OpenSSH that could allow unauthorised access to certain Linux accounts without valid passwords, with security researchers confirming that attackers successfully obtained root access on a vulnerable honeypot system.
The vulnerability, identified as CVE-2026-123158 and nicknamed SSHole, carries a CVSS severity score of 8.1. It affects specific Linux systems running OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled. Alpine Linux is among the affected distributions because its default OpenSSH server configuration meets these conditions.
According to cybersecurity intelligence firm Previdian, the first exploitation attempt was detected less than nine hours after details of the vulnerability became public.
The security flaw could allow an unauthenticated attacker to gain access to accounts deliberately configured without usable passwords by submitting an unusually long password. The attack does not require stolen login credentials or private SSH keys.
The vulnerability was discovered by security researcher Ozgun Kultekin, who identified a weakness in how OpenSSH handles certain password authentication requests.
The issue has since been addressed in OpenSSH version 10.6p2.
Investigations revealed that the vulnerability is connected to a change introduced in OpenSSH in 2016. The earlier modification was designed to address another security weakness, CVE-2016-6210, which allowed attackers to identify valid usernames through differences in authentication responses.
However, under specific conditions, the password-handling mechanism could mistakenly treat a failed password-hashing operation as a successful authentication attempt.
The problem occurs when an attacker submits a password between 257 and 1,024 bytes long. Under the affected conditions, the hashing operation fails and returns an asterisk (*) instead of a valid password hash.
OpenSSH then compares the returned value with the account’s stored password field. Where the account has an asterisk as its password hash, the comparison can result in successful authentication.
Security experts, however, stressed that the vulnerability does not provide unrestricted access to every account on an affected machine. Successful exploitation requires an account whose password field contains an asterisk, meaning the account has password authentication disabled at the system level.
Accounts protected by valid password hashes are not affected by this particular authentication bypass.
Safe Security warned that successful exploitation could expose organisations to additional security risks depending on the privileges attached to the compromised account.
Beyond gaining unauthorised SSH access, attackers could potentially access deployment credentials, application secrets and connected infrastructure. Such access could also provide opportunities for lateral movement across networks, privilege abuse and disruption of critical services.
The company explained that the immediate consequences depend largely on the permissions available to the compromised account.
Meanwhile, researchers confirmed that the vulnerability does not affect Dropbear SSH, Linux distributions using the glibc C library, non-Linux operating systems or systems that handle password authentication through PAM.
Previdian disclosed that it had recorded eight exploitation attempts originating from an IP address geolocated to Japan.
The company’s monitoring systems identified the first attempt less than nine hours after the vulnerability was published. More significantly, researchers confirmed that one of the attacks successfully obtained root access on a honeypot running Alpine Linux and OpenSSH.
Ryan Dewhurst, founder and chief executive officer of Previdian, said the attacking IP address, 89.116.89[.]18, submitted unusually long passwords in an attempt to bypass authentication.
According to Dewhurst, the attacker subsequently executed reconnaissance commands, including id, uname and hostname, through non-interactive SSH sessions.
These commands are commonly used by attackers to gather information about compromised systems, identify operating system details and determine the privileges available to them.
Following the discovery, cybersecurity professionals advised organisations running affected OpenSSH configurations to immediately upgrade to version 10.6p2 or install the security update provided by their Linux distribution.
Administrators are also advised to restart the SSH service after applying the necessary updates to ensure that the patched version is active.
Alpine Linux has separately urged users to investigate authentication logs for suspicious entries, particularly records showing successful password logins involving accounts that should not permit password-based authentication.
The distribution recommended examining /var/log/messages for SSH entries containing the phrase “Accepted password for” involving accounts such as Alpine, root or other users configured for key-based authentication only.
Administrators have also been advised to review the use of the doas privilege-management utility, recently created user accounts, files and authorised SSH keys on exposed systems.
Alpine Linux warned that organisations unable to establish whether unauthorised access occurred should treat potentially affected machines as compromised and conduct appropriate security investigations.
The rapid exploitation of SSHole highlights the risks associated with newly disclosed vulnerabilities, particularly when attackers begin scanning for vulnerable systems before organisations have completed security updates.