Hackers Exploit OpenSSH Flaw to Bypass Linux Password Checks
Read Time:5 Minute, 12 Second
Attackers are exploiting an OpenSSH flaw that lets them log in to certain Linux servers without knowing a password. The US Cybersecurity and Infrastructure Security Agency added the flaw, CVE-2026-123158, to its Known Exploited Vulnerabilities catalog on November 9, 2026. The bug is known as SSHole. The concern for administrators is immediate because a fix has been available since November 5 and researchers have already seen attackers use the flaw.
The alert applies to a specific set of Linux installations, including some Alpine Linux systems. Whether a machine is exposed depends on how the SSH server was built, which authentication settings it uses and how its local accounts are configured. For cloud and security teams in India, the same technical conditions apply. The November 12 remediation deadline reported by The Hacker News applies to US federal civilian agencies.
SSHole at a glance
| Item | What is confirmed |
|---|---|
| Vulnerability | CVE-2026-123158, an OpenSSH server authentication bypass on certain Linux systems |
| Fix released | November 5, 2026, in portable OpenSSH 10.6p2 and patched Alpine packages |
| Exploitation status | Observed by security researchers and added to the US exploited vulnerabilities catalog on November 9 |
| Federal deadline | November 12, 2026, for US federal civilian agencies |
How a key-only account can accept a password
SSH gives administrators an encrypted way to connect to another machine. Many administrators configure accounts to sign in with an SSH key and leave them without a usable password. On Alpine, such an account can have an asterisk in the field where a password hash would normally sit. Under ordinary conditions, a password should never match that entry.
On affected systems, a failed calculation inside the musl C library can return the same asterisk. OpenSSH can treat the result as a valid match. The OpenSSH team describes the underlying error as originating outside the SSH daemon, but its 10.6p2 release notes explain that the daemon can avoid the error. The release includes that workaround.
Several conditions have to line up. The attacker must be able to reach the SSH server. The vulnerable server uses musl with PAM, the system’s pluggable authentication layer, disabled. Password authentication has to be enabled. The target account needs the asterisk entry, and Alpine’s advisory specifies that at least one other local account must have a compatible SHA-256 or SHA-512 password hash. The user whose name is targeted and the user who has that hash can be different people.
Why the cloud image matters
Alpine’s official tiny-cloud images are an example of how a system’s risk can change after deployment. Alpine’s security advisory says older versions of these images shipped with an account named alpine that had passwordless administrative access through doas. Alpine says those images were safe on first boot under their default conditions, but adding a compatible password hash could make them exploitable. An administrator setting a console password can create that condition.
A successful login under an ordinary user account gives an attacker the permissions of that account. If it can elevate to root without a password, the attacker can gain administrative access. Alpine also says containers that never run the SSH daemon are outside the scope of this flaw. For teams with many Alpine-based containers, checking whether sshd actually runs is a faster starting point than counting every container that uses the distribution.
What researchers saw after login
BleepingComputer’s reporting describes researchers seeing attempts to query cloud metadata, read credential files and add SSH keys after gaining access. Adding a key matters because it can give an intruder another route into the system after the original flaw has been fixed.
The public observations came from specific monitoring networks. They establish that exploitation has happened, while leaving the total number of compromised servers unknown. Routine scans against port 22 include plenty of unrelated activity and cannot be used to count SSHole attacks. The sources also give no verified count of affected organisations in India.
The same US catalog update included GPUStack, FreeSWITCH and IBM Aspera Faspex. Those are separate vulnerabilities. A team that runs more than one of those products needs to identify the applicable fix for each. For another case involving the time between detection and disclosure, see our coverage of Australia’s proposed AI breach reporting rules.
What infrastructure teams can check now
Verify the package and the running service
Alpine published fixes for individual release branches. Some patched builds retain older upstream version numbers, so compare the installed package revision with the table in Alpine’s advisory. A rule that flags every version string below 10.6p2 can misread a distribution package with the fix backported.
After installing the update, restart sshd. Alpine explicitly says a package upgrade alone leaves the running server in place. In fleets built from machine images, teams can also update the source image and check whether new instances start with the fixed package. Updating the image and patching existing machines cover different sets of servers.
Review the window before the patch
If an update has to wait, Alpine advises disabling password authentication and restarting the service. It also advises testing key access before closing the current session. Keep track of the machines where that change was made and when it took effect.
For exposed systems, Alpine recommends reviewing successful password logins to accounts that had no usable password. It also recommends checking newly created users, files, SSH keys and use of doas. A fix closes the login bypass going forward. Log review helps answer the separate question of whether someone used it before the restart.
Frequently asked questions
What is SSHole?
SSHole is the name given to CVE-2026-123158, a flaw that can let attackers bypass password checks for some accounts on vulnerable Linux servers running OpenSSH.
Does every Alpine Linux container need this OpenSSH patch?
The vulnerability requires a running SSH server. Alpine says containers that do not run sshd are unaffected by this particular flaw.
Does installing the Alpine update restart the SSH service?
No. Alpine says administrators must restart sshd after the upgrade so the running service uses the patched code.
Does the November 12 deadline apply to companies in India?
The cited deadline applies to US federal civilian agencies. A server in India can still be vulnerable if it meets the technical conditions.
Happy
0 %
Sad
0 %
Excited
0 %
Sleepy
0 %
Angry
0 %
Surprise
0 %
0
0
Average Rating