Attackers began probing the recently disclosed OpenSSH password-authentication bypass within hours of its public release, and at least one attempt reached root access on a honeypot running Alpine Linux and OpenSSH, according to threat intelligence firm Previdian. The company’s founder, Ryan Dewhurst, told Help Net Security that the first observed attempt arrived less than nine hours after the vulnerability was published.
The flaw, tracked as CVE-2026-123158 and known as SSHole, can let a remote attacker log in to accounts that have no password set on certain Linux systems using the musl C library. The vulnerable configuration requires OpenSSH to run without Pluggable Authentication Modules (PAM), with password authentication enabled and specific account password-hash conditions. The issue does not affect every OpenSSH installation.
Previdian’s public vulnerability record lists exploitation attempts observed by its sensors. Dewhurst’s statement to Help Net Security describes a successful root login on the firm’s honeypot; neither source reports a confirmed compromise of a customer system.
OpenSSH released version 10.6p2 on November 5 with a critical security workaround for Linux systems using musl with PAM disabled, according to the project’s release announcement. Alpine Linux also published fixed package revisions for its supported and older release branches in its security advisory. The exploitation report follows the original disclosure of the OpenSSH flaw affecting passwordless accounts on Alpine Linux.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
