OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158)

Security firm Previdian reports active exploitation of a newly disclosed OpenSSH vulnerability, CVE-2026-123158, dubbed "sshole," which allows remote attackers to log into accounts that are supposed to have no password at all on Alpine Linux and other systems built on the musl C library. The bug was patched in OpenSSH 10.6p2 on November 5, yet Previdian says it detected its first attack attempt less than nine hours after the CVE was published, with one Japan-based IP address successfully gaining root access on a honeypot and running basic recon commands like id, uname and hostname.

The root cause traces back to a 2016 OpenSSH fix for a username-enumeration timing bug (CVE-2016-6210), combined with how musl's crypt() function since 2012 rejects passwords over 256 bytes and returns an asterisk — which coincidentally matches the asterisk stored for accounts with no real password hash, tricking sshd into granting access. This affects password-based logins (enabled by default) on musl-based, non-PAM systems such as Alpine, OpenWrt, Buildroot, Yocto and many Docker images, and is especially dangerous on Alpine's AWS/Azure cloud images where the default user has passwordless root-equivalent access via doas.

Systems using glibc, PAM, Dropbear or OpenBSD are not affected. Admins on vulnerable musl systems are urged to update to OpenSSH 10.6p2, restart the sshd service (patching alone doesn't stop the already-running process), or temporarily disable password authentication, while checking logs for suspicious "Accepted password" entries tied to accounts that shouldn't have passwords.