Hackers Exploiting ‘SSHole’ Authentication Bypass in OpenSSH
Hackers exploit SSHole auth bypass in OpenSSH, affecting Alpine and other Linux distros.
A critical authentication bypass vulnerability, dubbed SSHole (CVE-2026-123158), in OpenSSH is being actively exploited by threat actors. The flaw allows attackers to bypass authentication for certain accounts, including root, on Linux distributions using musl libc with PAM disabled, such as Alpine. Exploitation attempts have been observed by botnets and crypto miners, with broader threat actor adoption anticipated.
AI summary of the linked source. Not reviewed by an editor. How this works
Run OpenSSH?
Get an email when a new story names OpenSSH, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe SSHole vulnerability (CVE-2026-123158) exposes a critical flaw in OpenSSH that allows threat actors to completely bypass authentication, including for root accounts, on systems running musl libc with PAM disabled — a common configuration in lightweight Linux distributions like Alpine. Active exploitation by botnets and crypto miners confirms that attackers are rapidly weaponizing this flaw, meaning unpatched systems face immediate, real-world risk. This incident underscores how specific configuration choices (PAM disabled, musl libc) can silently elevate the impact of a vulnerability beyond what standard risk assessments anticipate. Organizations that lack timely patch cycles or accurate software inventories are most exposed, as they may not even know which systems are affected. The speed of botnet adoption demands emergency-level response, not routine patching cadences.
What helps against this
How we list vendors- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-123158