SSHole
CVE-2026-123158Authentication bypass in OpenSSH lets attackers log in with oversized passwords
An authentication bypass vulnerability in OpenSSH, dubbed SSHole, allows attackers to log into Linux accounts configured to block password authentication by entering a password longer than 256 bytes. It affects systems using the musl C library without PAM, such as Alpine Linux. The vulnerability is actively exploited and has been fixed in OpenSSH 10.6p2.
OpenBSD OpenSSH · Updated 9 Nov · From 2 of our stories and the public records
Being exploitedYesAttackers are using it
CISA known exploitedListedAdded 9 Nov; US agencies must fix by 12 Nov
SeverityhighCVSS 8.1 of 10
FixAvailableFixed versions below
Am I affected?
If you run a version older than the fixed one for your line, yes.
| Version line | Fixed in |
|---|---|
| OpenSSH 10.6p2 | 10.6p2 |
What to do
- Update OpenSSH to version 10.6p2 immediately.
- If you use a distribution that relies on musl libc without PAM, such as Alpine Linux, prioritize patching.
- Follow CISA's guidelines and apply the patch by November 12, 2026, if you are a US federal agency.
What happened
- 5 NovSecurity researcher Özgün Kültekin discloses the SSHole authentication bypass vulnerability.
- 6 NovActive exploitation of SSHole is reported within hours of the disclosure.
- 9 NovCISA adds the vulnerability to its Known Exploited Vulnerabilities catalog.
- 12 NovDeadline for US federal agencies to patch the vulnerability as required by CISA.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-123158 | OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability | high 8.1 | 9 Nov | 1.0% |
Our reporting
9 NovHackers exploit 'SSHole' vulnerability in OpenSSH to breach Linux systems5 NovDecade-old *sshole flaw lets attackers log into password-disabled Linux accounts via oversized passwordsReported elsewhere
BleepingComputer · 9 NovHackers exploit SSHole OpenSSH flaw to breach Linux systems ↗CISA · 9 NovCISA Adds Four Known Exploited Vulnerabilities to Catalog ↗The Hacker News · 6 NovHackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot ↗Help Net Security · 6 NovOpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158) ↗The records
CISA known-exploited catalog ↗CVE-2026-123158 on NVD ↗Is anything you run affected?Connect Zotpaper to Claude, ChatGPT or Cursor and ask. It checks your project's packages against this vulnerability and every other one in the advisory databases, and says what to update. Your first 20 lookups are free.
Try it free