Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot Ravie LakshmananNov 06, 2026Vulnerability / Cyber Attack Threat actors are attempting to exploit a recently disclosed security flaw impacting OpenSSH that can enable sign-ins to accounts that have no password set, according to Previdian. The vulnerability, tracked as CVE-2026-123158 (CVSS score: 8.1) and codenamed SSHole (or *sshole), impacts Linux systems that run OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled, including Alpine Linux's default OpenSSH server configuration. An unauthenticated attacker can supply an oversized password to access accounts that are deliberately configured without usable passwords, without having to steal credentials or SSH keys. The issue, discovered by security researcher Ozgun Kultekin, has been addressed in OpenSSH 10.6p2. The underlying issue dates back to a patch introduced in 2016 to fix a username enumeration vulnerability tracked as CVE-2016-6210. Under specific conditions, the password-handling behavior in OpenSSH mistakenly interprets a failed password-hashing operation as successful authentication by producing the same value ("*") used to indicate that an account with password disabled at the system level. An attacker can trigger the vulnerability to authenticate to certain password-disabled accounts using an arbitrary password between 257 and 1,024 bytes long, causing the hash attempt to fail and returning an asterisk. The sshd daemon then compares with the asterisk stored in the account's password field, leading to a successful login. To be clear, successful exploitation requires at least one account with an asterisk (*) as its password hash. It does not allow attackers to bypass passwords on accounts with valid password hashes. "A successful SSHole attack grants access with the compromised account's existing permissions," Safe Security said. "For enterprise, the consequences of SSHole depend on the privileges of the compromised account." "While unauthorized SSH access is the immediate impact, attackers may also gain access to deployment credentials, application secrets, and connected infrastructure, potentially enabling lateral movement or service disruption." It's worth noting that the vulnerability does not affect Dropbear, glibc-based Linux distributions, non-Linux systems, and systems that check passwords through PAM. Threat intelligence firm Previdian said it observed the first exploitation attempt less than nine hours after the CVE publication, adding it has confirmed successful root access on a honeypot running Alpine Linux and OpenSSH. Telemetry data shows a total of eight exploitation attempts from an IP address geolocated to Japan. "The observed source IP, 89.116.89[.]18, used oversized passwords to bypass authentication and ran reconnaissance commands including id, uname and hostname through non-interactive SSH sessions," Ryan Dewhurst, founder and CEO of Previdian, said in a statement shared with The Hacker News. Affected users are advised to install OpenSSH 10.6p2 or their distribution's patched package, and then restart sshd. Alpine is also recommending that users investigate "Accepted password for" log entries involving accounts that should not accept password logins. "Look in /var/log/messages for sshd lines reading Accepted password for an account that has no password (alpine, root, or any key-only user)," Alpine said. "Review doas use and recently created users, files and authorized keys on exposed machines. If you cannot rule out a login, treat the machine as compromised." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. Cyber Attack, linux, network security, Vulnerability Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen AI-Generated Fake Login Pages Are Making Account Takeovers Easier Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Register for Free Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. Accelerate Incident Response: 95% Faster Containment Cut containment time from 48 hours to 3. Read the Orchid IR case study. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll Your Attack Surface Is Growing Faster Than Your Team Can Respond PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security