Attackers have begun exploiting SSHole, a recently patched flaw in the OpenSSH remote-login software that lets them sign in without a valid password on Alpine Linux and other systems built on the musl library, SecurityWeek reported Monday. Security firm watchTowr says only botnets and cryptocurrency miners have used it so far, but any organization running affected servers, containers or network devices with password logins enabled should treat unpatched machines as exposed.
What Happened
The flaw, tracked as CVE-2026-123158 and rated 8.1 out of 10 for severity, lets anyone who can reach a vulnerable SSH server log in to accounts that were never meant to accept a password, such as root or users set up for key-only access, by typing any password 257 to 1,024 characters long. It affects Linux systems that use musl, a lightweight version of the C standard library, with PAM, the framework that usually checks passwords, turned off. That includes Alpine, OpenWrt, Buildroot and Yocto. The Primary Wire reported the fix Nov. 5.
WatchTowr and Previdian warned over the weekend that the bug was being exploited, and GreyNoise and Defused also reported attempts, SecurityWeek said. Previdian, citing its own decoy sensors, counted 20 exploitation attempts from 13 attacker addresses in nine countries between Nov. 6 and Nov. 8.
Help Net Security reported Nov. 6 that Previdian saw its first attempt less than nine hours after the flaw was published and confirmed root access on a decoy Alpine server. Proof-of-concept exploits have been posted on GitHub, Help Net Security reported. When it published, the U.S. Cybersecurity and Infrastructure Security Agency had not added the flaw to its Known Exploited Vulnerabilities catalog, which sets patch deadlines for federal agencies.
Why It Matters
Attacks began within hours of disclosure, leaving little room for slow patch cycles. Systems built on the more common glibc library, such as Debian and Ubuntu, are not affected, Help Net Security reported. But Alpine is a popular base for container images and cloud templates, and musl builds are common in routers and embedded devices that inventories often miss and that are rarely updated.
Boards should ask whether their teams know which internet-facing systems run a musl-based build with SSH password logins on, the OpenSSH default.
What Defenders Should Do
The fix is OpenSSH 10.6p2, and Alpine's advisory lists patched packages for every release branch back to 3.16. Alpine says the running SSH service stays vulnerable until it is restarted after the update. Until then, turning off password logins blocks the bypass.
Alpine also advises checking logs for password logins to accounts that have no password, looking for new user accounts and unfamiliar SSH keys, and treating any machine where a break-in cannot be ruled out as compromised.
What to Watch
- Whether CISA lists the flaw, which would set a federal patch deadline.
- Whether use of the bug spreads beyond botnets and miners, which SecurityWeek expects.
- Firmware updates from router and appliance makers that ship musl-based OpenSSH.
