Key Takeaways
- Previdian said its sensors saw the first attempt to exploit OpenSSH flaw CVE-2026-123158 (SSHole) less than nine hours after the CVE was published on November 5, 2026, and that one attempt gained root access to a Previdian honeypot running Alpine Linux.
- CVE-2026-123158 lets an attacker who can reach the SSH port log in to accounts that have no password set, on Linux systems that run OpenSSH with the musl C library and without PAM, which is how Alpine Linux builds its default openssh-server package.
- OpenSSH released version 10.6p2 with a fix for CVE-2026-123158 on November 5, 2026, and Alpine published fixed openssh packages for every release from 3.16 to 3.24 and edge, including releases that no longer get regular updates.
- Debian, Ubuntu, Fedora, and other Linux distributions built on glibc are not affected by CVE-2026-123158, and neither are systems that check passwords through PAM, the Dropbear SSH server, or OpenBSD.
What happened
The OpenSSH project released OpenSSH 10.6p2 on November 5, 2026, with what its release notes call "a critical security workaround that affects Linux systems that use the musl libc and PAM disabled." OpenSSH is an implementation of the Secure Shell (SSH) protocol, which is used to log in to and manage computers remotely, and includes both client and server software. Musl is the C library, the basic system code, that Alpine Linux is built on. PAM (pluggable authentication modules) is the most common Linux login framework, according to CSO Online.
The flaw is tracked as CVE-2026-123158. Özgün Kültekin of the security testing firm Wakefield, the researcher who found it, nicknamed it SSHole, Help Net Security reported. The flaw carries a severity score of 8.1 out of 10, according to The Hacker News.
"An attacker who can reach your SSH port can log in without knowing any password," Alpine Linux said in its security advisory. The attack works against accounts that are set up to have no password, which is normal for accounts that log in only with SSH keys, Alpine said. The researcher says the problem has existed since 2016, BleepingComputer reported.
OpenSSH said it considers the root cause to be outside its own code but exploitable through it. Kültekin said he found the flaw using AI agents that ran about 17,600 test logins against OpenSSH built in different ways, BleepingComputer reported.
Exploitation in the wild
Previdian, a threat intelligence firm, said its first observed exploitation attempt arrived less than nine hours after the CVE was published. Previdian founder Ryan Dewhurst said the firm had confirmed root access on a Previdian honeypot running Alpine Linux and OpenSSH, Help Net Security and The Hacker News reported. A honeypot is a decoy server set up to attract attackers, and root access gives full control of the system.
Previdian lists the flaw on its own known exploited vulnerabilities page with "confirmed" confidence and a first observation on November 6. The flaw is not listed in the Known Exploited Vulnerabilities (KEV) catalog of the U.S. Cybersecurity and Infrastructure Security Agency (CISA), Previdian and Help Net Security said.
Proof-of-concept exploits, code that demonstrates an attack, have been posted on GitHub, but Previdian cautions that they are unverified and could contain malware, according to Help Net Security.
Who is affected
Alpine said a system is affected when it runs Alpine's openssh-server package, which is built without PAM, with password logins turned on, the OpenSSH default. The system also needs an account with no password set and at least one other account that has a password. Alpine listed every release it checked, 3.21 through 3.24 and edge, as affected, along with releases 3.16 to 3.20, which no longer receive regular updates.
Alpine's official tiny-cloud images, from 3.18.11 through 3.24.3, ship an "alpine" user with no password and passwordless doas, a tool for running commands as root. Alpine said these images are safe on first boot. They become exploitable once any account on the machine gets a password, and an attacker could then log in as the alpine user and become root.
Kültekin lists OpenWrt, Buildroot, and Yocto among other musl-based systems worth checking, according to Help Net Security. Debian, Ubuntu, Fedora, and other systems built on glibc are not affected, nor are systems that check passwords through PAM, the Dropbear SSH server, or OpenBSD, The Hacker News and Help Net Security reported. Alpine said containers that do not run an SSH server inside them are not affected.
What organizations should do
Alpine told anyone running an SSH server on Alpine Linux to update the openssh package and then restart the SSH service, because upgrading the package alone does not replace the running program. Alpine 3.21.10, 3.22.8, 3.23.8, and 3.24.4 contain the fixed package, and Alpine has published fixed packages for each release back to 3.16, it said.
If an update is not possible yet, Alpine advised turning off password logins in the SSH server settings and restarting the service. OpenSSH developer Damien Miller urged anyone running musl-based Linux without PAM to turn off password logins or disable SSH on those systems immediately, Help Net Security reported.
To check for a break-in, Alpine advised looking in system logs for successful password logins to accounts that have no password, and reviewing doas use, recently created users, files, and authorized SSH keys on exposed machines. "If you cannot rule out a login, treat the machine as compromised," Alpine said.