admin
Threat actors are attempting to exploit a recently disclosed security flaw impacting OpenSSH that can enable sign-ins to accounts that have no password set, according to Previdian.
The vulnerability, tracked as CVE-2026-123158 (CVSS score: 8.1) and codenamed SSHole (or *sshole), impacts Linux systems that run OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled, including Alpine Linux’s default OpenSSH server configuration.
An unauthenticated attacker can supply an oversized password to access accounts that are deliberately configured without usable passwords, without having to steal credentials or SSH keys. The issue, discovered by security researcher Ozgun Kultekin, has been addressed in OpenSSH 10.6p2.
The underlying issue dates back to a patch introduced in 2016 to fix a username enumeration vulnerability tracked as CVE-2016-6210. Under specific conditions, the password-handling behavior in OpenSSH mistakenly interprets a failed password-hashing operation as successful authentication by producing the same value («*») used to indicate that an account with password disabled at the system level.
An attacker can trigger the vulnerability to authenticate to certain password-disabled accounts using an arbitrary password between 257 and 1,024 bytes long, causing the hash attempt to fail and returning an asterisk. The sshd daemon then compares with the asterisk stored in the account’s password field, leading to a successful login.
To be clear, successful exploitation requires at least one account with an asterisk (*) as its password hash. It does not allow attackers to bypass passwords on accounts with valid password hashes.
«A successful SSHole attack grants access with the compromised account’s existing permissions,» Safe Security said. «For enterprise, the consequences of SSHole depend on the privileges of the compromised account.»
«While unauthorized SSH access is the immediate impact, attackers may also gain access to deployment credentials, application secrets, and connected infrastructure, potentially enabling lateral movement or service disruption.»
 |
| Image Source: Safe Security |
It’s worth noting that the vulnerability does not affect Dropbear, glibc-based Linux distributions, non-Linux systems, and systems that check passwords through PAM.
Threat intelligence firm Previdian said it observed the first exploitation attempt less than nine hours after the CVE publication, adding it has confirmed successful root access on a honeypot running Alpine Linux and OpenSSH. Telemetry data shows a total of eight exploitation attempts from an IP address geolocated to Japan.
«The observed source IP, 89.116.89[.]18, used oversized passwords to bypass authentication and ran reconnaissance commands including id, uname and hostname through non-interactive SSH sessions,» Ryan Dewhurst, founder and CEO of Previdian, said in a statement shared with The Hacker News.
Affected users are advised to install OpenSSH 10.6p2 or their distribution’s patched package, and then restart sshd. Alpine is also recommending that users investigate «Accepted password for» log entries involving accounts that should not accept password logins.
«Look in /var/log/messages for sshd lines reading Accepted password for an account that has no password (alpine, root, or any key-only user),» Alpine said. «Review doas use and recently created users, files and authorized keys on exposed machines. If you cannot rule out a login, treat the machine as compromised.»
