OpenSSH SSHole attacks reached an Alpine honeypot within nine hours
Attackers began testing the SSHole vulnerability in OpenSSH less than nine hours after its disclosure, and Previdian said it confirmed successful root access on an Alpine Linux honeypot. The activity affects a limited configuration, but it gives unauthenticated attackers SSH access to some accounts that have no usable password.
The flaw is tracked as CVE-2026-123158 and has a CVSS score of 8.1, according to the report. It affects Linux systems running OpenSSH with the musl C library when Pluggable Authentication Modules, or PAM, are disabled. The report specifically includes Alpine Linux's default OpenSSH server configuration.
An attacker does not need a stolen password or SSH key for the vulnerable login path. The attacker sends a password between 257 and 1,024 bytes long to an account whose password field contains an asterisk, causing password-hashing to fail and OpenSSH to treat the result as a successful match. Accounts with valid password hashes are not affected by this bypass.
Previdian reported eight exploitation attempts from an IP address geolocated to Japan. Its telemetry showed the source using oversized passwords and running the reconnaissance commands id, uname and hostname through non-interactive SSH sessions. The report said the observed honeypot activity achieved root access on Alpine Linux and OpenSSH.
OpenSSH 10.6p2 fixes the issue, according to the report. Administrators should install that release or their distribution's patched package and restart sshd. The report said the vulnerability does not affect Dropbear, glibc-based Linux distributions, non-Linux systems, or systems that check passwords through PAM.
Alpine recommends checking /var/log/messages for sshd entries reading "Accepted password for" accounts that should not accept password logins. Administrators should also review doas use, recently created users, files and authorized keys on exposed machines. Alpine said operators who cannot rule out a login should treat the machine as compromised.