OpenSSH SSHole Authentication Bypass Vulnerability (CVE-2026-123158)

The Threat

On November 5th, 2026, the OpenSSH project released version 10.6p2 to fix CVE-2026-123158 (CVSS: 8.1), an authentication bypass in sshd dubbed "SSHole". An unauthenticated remote attacker who can reach the SSH port can log in without a valid password by sending an oversized password to an account that has no password set.

Since initial disclosure, vendors including Previdian and GreyNoise have reported exploitation in the wild. As exploitation is ongoing, organizations that run OpenSSH on Alpine or other musl-based systems should ensure that relevant patches are applied immediately.

What we're doing about it

• eSentire's Managed Vulnerability Service (MVS) has plugins in place to identify devices vulnerable to CVE-2026-123158
• eSentire customers can employ the Vulnerabilities and Inferred Vulnerabilities pages in Atlas Portal to search for potentially vulnerable assets
• eSentire's Threat Response Unit (TRU) is tracking this topic for additional information and detection opportunities

What you should do about it

• After performing a business impact review, apply the relevant security patches immediately
  • Upgrade to OpenSSH 10.6p2 or the distribution's patched package, then restart sshd
• If patching is not immediately possible, set "PasswordAuthentication no" in the sshd configuration and restart sshd, or disable SSH on affected systems

Additional information

The flaw affects Linux systems that run OpenSSH on the musl C library with PAM disabled, including the default OpenSSH server configuration on Alpine Linux. glibc-based distributions, such as Debian, Ubuntu and Fedora, and systems that check passwords through PAM are not affected. Although the vulnerable configuration is specific, the potential reach is broad because SSH is the standard way to administer Linux and Unix systems, and OpenSSH is the most widely deployed implementation. SSH is commonly enabled on servers, cloud instances, virtual machines, and other network devices, and embedded and IoT systems, and it is frequently reachable from the Internet.

Exploitation requires an account whose password field is *, at least one other local account with a $5$ or $6$ password hash, and sshd build without PAM, and password authentication enabled, which is the default. The root cause is an interaction between a 2016 OpenSSH change and musl's handling of long passwords, which causes a failed hash comparison to be treated as a match. Root login remains out of reach on default Alpine settings unless PermitRootLogin has been changed.

Previdian reported 20 exploitation attempts across nine countries between November 6th and 8th and confirmed root access on an Alpine Linux honeypot. GreyNoise observed its first successful exploitation on November 7th. Per SecurityWeek, WatchTowr reports that only botnets and cryptocurrency miners have used the flaw so far. It should be noted that botnets and cryptocurrency miners are often early exploit adopters, as they are easily monetizable. The success of early attacks may indicate more widespread adoption in the immediate future.

References

[1] https://previdian.com/CVE-2026-123158
[2] https://nvd.nist.gov/vuln/detail/cve-2026-123158
[3] https://sshole.events.greynoise.io/
[4] https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/
[6] https://www.securityweek.com/hackers-exploiting-sshole-authentication-bypass-in-openssh/