{"id":4016,"date":"2026-11-06T18:18:18","date_gmt":"2026-11-06T18:18:18","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=4016"},"modified":"2026-11-06T18:18:18","modified_gmt":"2026-11-06T18:18:18","slug":"hackers-target-openssh-sshole-flaw-within-hours-of-disclosure-gain-root-on-honeypot","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=4016","title":{"rendered":"Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Nov 06, 2026<\/span><\/span>Vulnerability \/ Cyber Attack<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Threat actors are attempting to exploit a recently disclosed security flaw impacting OpenSSH that can enable sign-ins to accounts that have no password set, according to Previdian<\/a>.<\/p>\n

The vulnerability, tracked as CVE-2026-123158<\/a><\/strong> (CVSS score: 8.1) and codenamed SSHole (or *sshole), impacts Linux systems that run OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled, including Alpine Linux’s default OpenSSH server configuration.<\/p>\n

An unauthenticated attacker<\/a> can supply an oversized password to access accounts that are deliberately configured without usable passwords, without having to steal credentials or SSH keys. The issue, discovered<\/a> by security researcher Ozgun Kultekin, has been addressed in OpenSSH 10.6p2<\/a>.<\/p>\n

The underlying issue dates back to a patch introduced in 2016 to fix a username enumeration vulnerability tracked as CVE-2016-6210<\/a>. Under specific conditions, the password-handling behavior in OpenSSH mistakenly interprets a failed password-hashing operation as successful authentication by producing the same value (\u00ab*\u00bb) used to indicate that an account with password disabled at the system level.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

An attacker can trigger the vulnerability to authenticate to certain password-disabled accounts using an arbitrary password between 257 and 1,024 bytes long, causing the hash attempt to fail and returning an asterisk. The sshd daemon then compares with the asterisk stored in the account’s password field, leading to a successful login.<\/p>\n

<\/p>\n

To be clear, successful exploitation requires at least one account with an asterisk (*) as its password hash. It does not allow attackers to bypass passwords on accounts with valid password hashes.<\/p>\n

\u00abA successful SSHole attack grants access with the compromised account’s existing permissions,\u00bb Safe Security said<\/a>. \u00abFor enterprise, the consequences of SSHole depend on the privileges of the compromised account.\u00bb<\/p>\n

\u00abWhile unauthorized SSH access is the immediate impact, attackers may also gain access to deployment credentials, application secrets, and connected infrastructure, potentially enabling lateral movement or service disruption.\u00bb<\/p>\n\n\n\n\n
\"\"<\/a><\/td>\n<\/tr>\n
Image Source: Safe Security<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

It’s worth noting that the vulnerability does not affect<\/a> Dropbear, glibc-based Linux distributions, non-Linux systems, and systems that check passwords through PAM.<\/p>\n

Threat intelligence firm Previdian said it observed the first exploitation attempt less than nine hours after the CVE publication, adding it has confirmed successful root access on a honeypot running Alpine Linux and OpenSSH. Telemetry data shows a total of eight exploitation attempts from an IP address geolocated to Japan.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

\u00abThe observed source IP, 89.116.89[.]18, used oversized passwords to bypass authentication and ran reconnaissance commands including id, uname and hostname through non-interactive SSH sessions,\u00bb Ryan Dewhurst, founder and CEO of Previdian, said in a statement shared with The Hacker News.<\/p>\n

Affected users are advised to install OpenSSH 10.6p2 or their distribution’s patched package, and then restart sshd. Alpine is also recommending that users investigate \u00abAccepted password for\u00bb log entries involving accounts that should not accept password logins.<\/p>\n

\u00abLook in \/var\/log\/messages for sshd lines reading Accepted password for an account that has no password (alpine, root, or any key-only user),\u00bb Alpine said<\/a>. \u00abReview doas use and recently created users, files and authorized keys on exposed machines. If you cannot rule out a login, treat the machine as compromised.\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\ue804Ravie Lakshmanan\ue802Nov 06, 2026Vulnerability \/ Cyber Attack Threat actors are attempting to exploit a recently disclosed security flaw impacting OpenSSH that can enable sign-ins to accounts that have no password…<\/p>\n","protected":false},"author":1,"featured_media":4017,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[799,70,580,338,3790,582,2085,61,4071,492],"class_list":["post-4016","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-disclosure","tag-flaw","tag-gain","tag-hackers","tag-honeypot","tag-hours","tag-openssh","tag-root","tag-sshole","tag-target"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/4016","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4016"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/4016\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/4017"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4016"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4016"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4016"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}