SSHole: Attackers Race to Exploit OpenSSH Flaw That Lets Them Log In Without a Password

Threat actors are attempting to exploit a recently disclosed OpenSSH vulnerability known as SSHole (CVE-2026-123158, CVSS score 8.1), according to Previdian. The flaw affects Linux systems running OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled. This includes the default OpenSSH server configuration in Alpine Linux. An attacker with no credentials can send an oversized password and sign in to accounts that were deliberately set up without a usable password.

The problem traces back to a 2016 patch meant to fix a different issue. In specific conditions, OpenSSH treats a failed password-hashing step as a successful check, because it returns the same asterisk value used to mark accounts with passwords disabled. Exploitation needs at least one account with an asterisk as its password hash. Accounts with valid password hashes cannot be bypassed this way. The flaw was found by researcher Ozgun Kultekin and is fixed in OpenSSH 10.6p2.

The impact depends on the privileges of the account that is compromised. Safe Security warned that attackers may also reach deployment credentials, application secrets and connected infrastructure, which could allow lateral movement or service disruption. Dropbear, glibc-based Linux distributions, non-Linux systems and systems that check passwords through PAM are not affected.