Attackers wasted no time turning a newly disclosed OpenSSH flaw into a working break-in. Threat intelligence firm Previdian said it saw the first exploitation attempt less than nine hours after the vulnerability was published, and confirmed that an attacker gained root access on a honeypot running Alpine Linux and OpenSSH.

The flaw, tracked as CVE-2026-123158 and nicknamed "SSHole", carries a CVSS score of 8.1. It affects Linux systems that run OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled, including Alpine Linux's default OpenSSH server configuration. Previdian recorded eight exploitation attempts from a single IP address geolocated to Japan, with the attacker using oversized passwords to bypass authentication and running reconnaissance commands such as id, uname and hostname.

How a long password opens a locked account

The bug lies in how a failed password check is misread as a success. On musl-based systems, the crypt function refuses passwords longer than 256 bytes and signals the error by returning an asterisk. That asterisk matches the "*" stored in the password field of accounts deliberately set up with no usable password, such as root on Alpine or key-only service accounts. An attacker can therefore log in to such an account with any password between 257 and 1,024 bytes long, without stealing credentials or SSH keys.

Patch now and check your logs

The fix is OpenSSH 10.6p2, released on 5 November, and Alpine has backported patches to every release from 3.16 to 3.24. Administrators should install the patched package and restart sshd, since an upgrade alone does not restart the running daemon. Alpine also urges users to search logs for "Accepted password for" entries involving accounts that should never accept password logins, and to treat any machine with an unexplained login as compromised.