Hackers Exploit New OpenSSH ‘SSHole’ Flaw to Breach Alpine Linux Systems

Attackers began exploiting a newly disclosed OpenSSH authentication bypass within hours of its proof-of-concept going public, and the first confirmed successful breach landed just 40 hours after a patch shipped. The flaw, tracked as CVE-2026-123158 and nicknamed “SSHole,” lets an attacker log into accounts that were supposed to have password authentication disabled entirely.

The bug sits in how OpenSSH interacts with musl libc, the lightweight C library used by Alpine Linux and other minimal distributions that dominate container base images across cloud platforms. When a login attempt uses an oversized password, musl’s password-hashing function returns an error represented by the single character “*” — the same placeholder value stored in the shadow file for accounts that have password logins disabled. OpenSSH treats that match as valid, effectively handing an attacker a way in on accounts nobody expected to be reachable by password at all.

Exploitation requires a specific configuration — musl-based systems with PAM authentication disabled — so not every Linux server is exposed. But Alpine’s minimal footprint has made it the default base image for an enormous share of Docker containers and Kubernetes workloads, meaning the affected configuration is far more common in cloud-native infrastructure than the CVSS 8.1 severity score alone suggests. Root access is possible if the compromised account carries passwordless administrative privileges.

OpenSSH shipped a fix in version 10.6p2 on November 5. A public proof-of-concept appeared the same day, and exploitation attempts started almost immediately. According to threat-intelligence firm GreyNoise, the first confirmed successful in-the-wild compromise occurred November 7 at 00:46 UTC — about a day and a half after the patch was released — with 16 successful exploitation chains traced to six source IPs, numbers GreyNoise cautions likely undercount the full scope of activity. Separately, researchers at Previdian logged 20 exploitation attempts from 13 IP addresses across nine countries, while WatchTower linked some of the activity to existing botnet and cryptomining operations. Defused reported a smaller number of distinct actors with limited follow-through.

Once inside, attackers have been observed running reconnaissance commands, querying cloud metadata services (a common technique for harvesting cloud credentials), attempting to read password hashes and root SSH keys, and modifying authorized_keys files to maintain persistent access. In at least one case, an attacker deployed a custom Python-based command-and-control tool called TAC Agent — though in that instance the implant never received instructions because its C2 server was unreachable, as reported by BleepingComputer.

The roughly 40-hour gap between patch release and confirmed in-the-wild exploitation is consistent with a pattern security researchers have flagged repeatedly through 2026: once a proof-of-concept for an authentication bypass goes public, mass scanning and exploitation now typically follow within one to two days, leaving defenders a narrow window to patch before automated attacks arrive.

Administrators running musl-based systems, particularly Alpine Linux deployments in containerized or cloud environments, should update to OpenSSH 10.6p2 immediately. Where immediate patching isn’t possible, disabling SSH password authentication entirely closes the hole. Security teams should also audit logs for unexpected successful password logins on accounts whose shadow password field is set to an asterisk, check for unauthorized entries in authorized_keys files, and scan for any trace of TAC Agent or similar unfamiliar startup services.