Threat groups have begun exploiting a high-severity security vulnerability in the OpenSSH protocol, known as "SSHole" and identified as CVE-2026-123158. This vulnerability allows attackers to bypass the authentication process and gain unauthorized access to accounts, including the "root" account in specific environments.
The technical issue lies in how the system interprets whether a text string represents a password "hash" or not. In distributions that use the musl libc library with Pluggable Authentication Modules (PAM) disabled—such as Alpine, OpenWrt, Yocto, and Buildroot—an attacker can input a password ranging from 257 to 1024 characters in length. When this length is exceeded, the crypt() function in the musl library fails and returns the symbol "*" instead of a NULL value. Since accounts like "root" in these distributions store the "*" symbol in the password field, the OpenSSH server (sshd) interprets the result as a correct password and grants access.
Affected accounts in the Alpine distribution include the "root" account, any user created via adduser without a password, and users originating from directory services via musl-nscd.
Why is this threat extremely dangerous?
The danger lies in the fact that the vulnerability breaks one of the most important foundations of security in Linux systems, which is the protection of the "root" account. In affected systems, an attacker can obtain full privileges on the system without knowing the actual password. Security firms such as WatchTowr and Previdian have already observed active exploitation attempts; Previdian indicated that it detected 20 exploitation attempts from 13 different IP addresses across 9 countries over the past few days. Although current attacks are limited to botnets and crypto miners, projections suggest that more sophisticated threat groups may adopt this vulnerability soon.
How to protect and prevent
To protect systems, it is recommended to take the following steps immediately:
- Update OpenSSH: Upgrade to version 10.6p2 or later.
- Disable password authentication: Rely on SSH keys instead of passwords (Password Authentication).
- Review logs: Inspect system logs for abnormal or suspiciously long login requests.
- Disable the service: In critical cases that cannot be updated, disabling the SSH service may be the only temporary solution.