Hackers Exploit OpenSSH CVE-2026-123158 to Breach Linux Systems

Threat actors are actively exploiting a security flaw named "SSHole", tracked as CVE-2026-123158, in OpenSSH running on certain musl-based Linux distributions such as Alpine Linux. The flaw allows remote attackers to bypass authentication and access accounts with disabled passwords, potentially escalating to root privileges. Attacks commenced on 5 November following the public release of exploit code, with multiple cybersecurity firms confirming successful exploitation in the wild. While the affected systems are primarily lightweight and containerised cloud environments, Malaysian organisations managing Linux infrastructure should verify configurations and report incidents to Cyber999.

Key Facts

How Does the SSHole Flaw Work?

The vulnerability permits authentication bypass on accounts configured with an asterisk password hash to block password logins. When an attacker sends an oversized password, musl’s hashing function produces an error returning an asterisk. OpenSSH mistakenly treats this error value as a match for the stored hash, allowing unauthorised access under specific settings.

Disclosed by security researcher Ozgun Kultekin, the vulnerability does not affect accounts with valid password hashes. However, if a compromised account possesses passwordless administrative privileges, an attacker can attain root access.

Exploitation requires specific authentication settings and does not affect Linux accounts configured with valid password hashes.

Is the Vulnerability Being Exploited in the Wild?

Multiple cybersecurity firms have confirmed active exploitation, beginning on 5 November shortly after proof-of-concept exploit code appeared. Threat intelligence firm GreyNoise recorded sixteen successful compromise chains originating from six IP addresses, whilst network security company Previdian detected twenty exploitation attempts from thirteen attacker addresses across nine countries.

Finnish security company Defused observed a small number of actors attempting exploitation, though activity was not deemed widespread. In attacks observed by GreyNoise, attackers conducted system and container reconnaissance, queried cloud metadata services, read password hashes and root SSH keys, and modified authorized_keys files. One compromised host was infected with TAC Agent, a Python command-and-control implant containing Chinese-language logs and comments, though it failed to communicate with its external server. Offensive security firm watchTower also observed exploitation linked to botnet and cryptomining activity.

OpenSSH maintainers released version 10.6p2 to resolve the issue approximately four hours before exploit code was made publicly available.

What Should You Do?

• Upgrade OpenSSH to version 10.6p2 as soon as possible.
• Disable SSH password authentication on affected musl-based systems if updating cannot be carried out immediately.
• Review system authentication logs for unexpected successful password logins to accounts where the /etc/shadow password field is set to an asterisk (*).
• Check for unauthorised entries in authorized_keys files, unknown startup services, and files associated with the TAC Agent implant.
• Report suspected intrusions or cyber incidents within Malaysia to Cyber999 (MyCERT).

Common Questions

Does CVE-2026-123158 affect all Linux distributions?

No. The flaw specifically affects OpenSSH running on musl-based Linux distributions, including the lightweight Alpine distribution used in container and virtual environments. It does not compromise accounts configured with valid password hashes or systems running standard C libraries that handle oversized password hashing differently.

When was the first confirmed in-the-wild exploitation?

Exploitation attempts started on 5 November, with confirmed breaches recorded the following day. Threat intelligence firm GreyNoise logged its first successful in-the-wild exploitation on 7 November at 00:46 UTC, approximately forty hours after the vendor patch was issued.

Can attackers obtain root administrative access?

Yes. While the vulnerability bypasses authentication on accounts where passwords are disabled with an asterisk hash, attackers can achieve root administrative access if the compromised user account possesses passwordless administrative privileges on the target system.

Sources and Methodology

This dispatch is based solely on reporting published by BleepingComputer on 9 November 2026. Specific indicators of compromise and technical telemetry are published in the original reporting.