Hackers are actively exploiting an authentication bypass vulnerability in OpenSSH, dubbed 'SSHole', to steal credentials, execute commands, and establish persistent access on Linux systems, multiple cybersecurity firms have confirmed.
The flaw, tracked as CVE-2026-123158, was disclosed by security researcher Ozgun Kultekin last week. It affects OpenSSH running on certain musl-based Linux systems, including the lightweight Alpine distribution used in cloud and virtual environments. The vulnerability allows attackers to bypass authentication for accounts whose password hash is set to an asterisk (*), which normally prevents password logins. An oversized password causes musl's password-hashing function to return a * on error, which OpenSSH mistakenly treats as a match for the stored value.
Exploitation attempts began on November 5, the day a proof-of-concept exploit became available, with successful exploitation recorded the following day. OpenSSH maintainers released version 10.6p2 with a fix on November 5, while exploit code appeared roughly four hours later.
Finnish security company Defused said over the weekend that it had observed "a small amount of actors" trying to exploit SSHole, although activity was not widespread. Threat intelligence company GreyNoise recorded the first successful exploitation in the wild on November 7 at 00:46 UTC, approximately 40 hours after the fix, logging 16 successful exploitation chains targeting networks protected by GreyNoise from six source IP addresses linked to post-exploitation activity.
In attacks that GreyNoise observed, threat actors ran system and container reconnaissance, queried cloud metadata services, attempted to read password hashes and root SSH keys, and tried to modify SSH 'authorized_keys' files to gain persistent access. One attacker gained root privileges and installed TAC Agent, a Python command-and-control implant that supports shell command execution, system reconnaissance, file upload and download, and self-updating. The implant could not reach its command-and-control server and never received a task. GreyNoise noted the implant's comments, logs, and errors were in Chinese, which may be used in conjunction with other evidence to determine the attacker's origin.
Network security company Previdian confirmed successful exploitation, with telemetry showing 20 attempts from 13 attacker IP addresses in nine countries. Offensive security firm watchTower observed SSHole being exploited in attacks associated with botnets and cryptomining activity.
Analysis
Why This Matters
- The flaw is actively exploited in real-world attacks, not just theoretical.
- Affects Alpine Linux and other musl-based systems, which are widely used in cloud and containerized environments.
- Successful exploitation can lead to root access, credential theft, and persistent backdoors.
Background
OpenSSH is the most widely used implementation of the SSH protocol for secure remote login. The 'SSHole' vulnerability specifically targets systems using the musl C library, such as Alpine Linux, which is popular in Docker containers and cloud deployments due to its small footprint.
Key Perspectives
Ozgun Kultekin (security researcher who disclosed the flaw): explained that exploitation requires specific authentication settings, does not affect accounts with valid password hashes, and can lead to root access where the compromised account has passwordless administrative privileges.
Security firms (GreyNoise, Defused, Previdian, watchTower): confirmed real-world exploitation and provided evidence of post-exploitation activity including reconnaissance, credential theft, and cryptomining.
What to Watch
- Whether exploitation escalates as more attackers obtain and adapt the exploit code.
- Updates from cloud providers and organizations using Alpine Linux on their patching status.
- Additional indicators of compromise such as unexpected SSH keys or TAC Agent files.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedHackers are exploiting the SSHole vulnerability in OpenSSH to breach Linux systems.BleepingComputer: “Hackers exploit SSHole OpenSSH flaw to breach Linux systems. Hackers are actively exploiting the "SSHole" vulnerability (CVE-2026-123158) in OpenSSH to execute commands, steal credentials, and establish persistent access.”
- SupportedMultiple cybersecurity firms confirmed active exploitation, with attackers stealing credentials, executing commands and establishing persistent access.BleepingComputer: “Hackers are actively exploiting the "SSHole" vulnerability (CVE-2026-123158) in OpenSSH to execute commands, steal credentials, and establish persistent access. Multiple cybersecurity firms have confirmed the attacks”
- SupportedExploitation attempts began on November 5, the day a proof-of-concept exploit became available.BleepingComputer: “reporting that exploitation attempts began on November 5, the day a proof-of-concept exploit became available”
- SupportedwatchTower linked SSHole exploitation to attacks associated with botnets and cryptomining.BleepingComputer: “Offensive security firm watchTower said on November 6 that it observed SSHole being exploited in attacks associated with botnets and cryptomining activity.”
- SupportedThe vulnerability was disclosed by security researcher Ozgun Kultekin last week.BleepingComputer: “Disclosed by security researcher Ozgun Kultekin last week, SSHole allows bypassing authentication”
- SupportedThe flaw affects OpenSSH on certain musl-based Linux systems, including Alpine, and can allow authentication bypass for accounts whose password hash is an asterisk.BleepingComputer: “SSHole allows bypassing authentication in OpenSSH running on certain musl-based Linux systems, including the lightweight Alpine distribution used in cloud and virtual environments. The flaw lets attackers log in to accounts with a password hash is set to an asterisk (*)”
- SupportedAn oversized password causes musl's hashing function to return an asterisk on error, which OpenSSH treats as matching the stored account value.BleepingComputer: “An oversized password causes musl’s password-hashing function to return * on error, which OpenSSH mistakenly treats as a match for the account’s stored value.”
- SupportedSuccessful exploitation was recorded the day after attempts began.BleepingComputer: “with successful exploitation recorded the following day.”
- SupportedOpenSSH maintainers released version 10.6p2 with a fix on November 5, and exploit code appeared roughly four hours later.BleepingComputer: “OpenSSH maintainers fixed the vulnerability in version 10.6p2 released on November 5, while exploit code became available roughly four hours later.”
- SupportedDefused said it had observed “a small amount of actors” trying to exploit SSHole, though activity was not widespread.BleepingComputer: “Finnish security company Defused said over the weekend that it had observed "a small amount of actors" trying to exploit SSHole, although the activity was not widespread.”
- SupportedGreyNoise recorded its first successful in-the-wild exploitation on November 7 at 00:46 UTC, approximately 40 hours after the fix.BleepingComputer: “Threat intelligence company GreyNoise recorded the first successful exploitation of SSHole in the wild on November 7 at 00:46 UTC, approximately 40 hours after the fix.”
- SupportedGreyNoise logged 16 successful exploitation chains targeting its protected networks from six source IP addresses linked to post-exploitation activity.BleepingComputer: “The researchers logged 16 successful exploitation chains targeting networks protected by GreyNoise from six source IP addresses linked to post-exploitation activity.”