OpenSSH SSHole flaw allows root access on Alpine Linux within hours

Threat actors began exploiting a critical OpenSSH vulnerability, tracked as CVE-2026-123158 and codenamed SSHole, less than nine hours after its public disclosure. The flaw allows unauthenticated attackers to gain access to accounts configured without passwords on specific Linux distributions, including Alpine Linux. Security researchers confirmed successful root access on honeypots, highlighting the immediate risk to infrastructure relying on default configurations.

What happened

The vulnerability impacts Linux systems running OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled. This configuration is common in lightweight distributions like Alpine Linux, which uses it by default. An attacker can send an oversized password, between 257 and 1,024 bytes long, to an account that has no usable password set. Instead of rejecting the login, the system mistakenly authenticates the user.

Security researcher Ozgun Kultekin discovered the issue, which stems from a patch introduced in 2016 to fix a different vulnerability, CVE-2016-6210. The fix for username enumeration inadvertently created a logic error in password handling. When the hashing operation fails due to the oversized input, OpenSSH returns an asterisk character. The daemon then compares this result with the asterisk stored in the password field of disabled accounts, interpreting the match as a successful login.

Threat intelligence firm Previdian observed the first exploitation attempt rapidly after the CVE publication. Telemetry data identified eight attempts from an IP address geolocated to Japan. The attacker used oversized passwords to bypass authentication and executed reconnaissance commands such as id, uname, and hostname via non-interactive SSH sessions. Previdian confirmed that these attempts resulted in successful root access on a honeypot running Alpine Linux.

How it works

The core mechanism relies on how OpenSSH handles password verification for accounts that are deliberately locked or configured without passwords. In these cases, the system stores an asterisk (*) in the password field to indicate that password-based login is disabled. Normally, any password attempt should fail. However, when an attacker supplies a password string that exceeds the expected buffer size, the internal hashing function fails gracefully but returns the same asterisk character.

The sshd daemon does not distinguish between a legitimate hash failure and the stored placeholder. It sees the returned asterisk from the failed hash operation and matches it against the asterisk in the account's password field. This logical collision tricks the authentication module into granting access. The exploit only works on accounts where the password field is explicitly set to an asterisk. It does not affect accounts with valid password hashes or those using PAM for authentication checks.

This behavior is specific to the interaction between OpenSSH and the musl C library. Systems using the glibc library, Dropbear SSH, or non-Linux operating systems are not affected. Additionally, any system that delegates password checking to PAM remains secure because PAM handles the validation logic differently, avoiding the flawed comparison within OpenSSH itself.

Key details

• Vulnerability ID: CVE-2026-123158 with a CVSS score of 8.1.
• Affected Systems: Linux systems using OpenSSH on musl libc with PAM disabled, notably Alpine Linux defaults.
• Exploit Method: Sending an arbitrary password between 257 and 1,024 bytes to a password-disabled account.
• Patch Version: Fixed in OpenSSH 10.6p2.
• Active Exploitation: First attempts observed less than nine hours after disclosure; root access confirmed on honeypots.
• Limitations: Does not affect glibc-based distributions, Dropbear, or systems using PAM for authentication.

Why it matters

For engineering teams managing cloud infrastructure, this vulnerability highlights the risks associated with default configurations in lightweight container environments. Alpine Linux is widely used in Docker containers and Kubernetes clusters due to its small footprint. If these instances expose SSH ports and rely on key-only authentication without properly disabling password fields or enabling PAM, they become vulnerable to immediate takeover. The speed of exploitation demonstrates that automated scanners are already targeting this specific flaw.

The impact extends beyond initial access. As noted by Safe Security, a successful attack grants the permissions of the compromised account. If the target is a root account or a service account with elevated privileges, attackers can access deployment credentials, application secrets, and connected infrastructure. This facilitates lateral movement across the network, potentially leading to widespread service disruption or data exfiltration. The fact that the exploit requires no stolen credentials makes it particularly dangerous for exposed services.

What you can do

• Upgrade immediately to OpenSSH 10.6p2 or apply the patched package provided by your Linux distribution.
• Restart the sshd service after updating to ensure the new version is active.
• Check /var/log/messages for entries reading "Accepted password for" on accounts that should not accept passwords, such as root or alpine.
• Review doas usage, recently created users, files, and authorized keys on any exposed machines for signs of compromise.
• If you cannot rule out unauthorized login based on logs, treat the machine as compromised and isolate it.
• Consider enabling PAM if your distribution supports it, as this mitigates the vulnerability by changing the authentication flow.