Ethical Hacking News
A critical vulnerability in the OpenSSH protocol, tracked as CVE-2026-123158, has been discovered and confirmed by threat intelligence firm Previdian. The "SSHole" flaw allows hackers to gain root access on Linux systems without having to steal credentials or SSH keys, posing a significant threat to organizations that rely on Linux systems. Affected users are advised to install OpenSSH 10.6p2 or their distribution's patched package, and then restart sshd to prevent exploitation.
The OpenSSH protocol has a newly discovered vulnerability, tracked as CVE-2026-123158, which can be exploited to gain root access on Linux systems. The SSHole vulnerability affects Linux systems that run OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled. The vulnerability can be exploited by an unauthenticated attacker who supplies an oversized password to access accounts with no password set. The issue dates back to a patch introduced in 2016 to fix a username enumeration vulnerability. A successful SSHole attack can grant access with the compromised account's existing permissions, potentially enabling lateral movement or service disruption. Users are advised to install OpenSSH 10.6p2 or their distribution's patched package, and review logs for unauthorized access.
The cybersecurity landscape is a constantly evolving environment, with new vulnerabilities and threats emerging on a daily basis. In recent days, a critical vulnerability in the OpenSSH protocol has been discovered, which can be exploited by hackers to gain root access on Linux systems. The vulnerability, tracked as CVE-2026-123158, has been identified as the "SSHole" flaw, and it has already been confirmed by threat intelligence firm Previdian as having been successfully exploited in the wild.
The SSHole vulnerability is a complex issue that affects Linux systems that run OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled, including Alpine Linux's default OpenSSH server configuration. According to the CVE documentation, the vulnerability can be exploited by an unauthenticated attacker who supplies an oversized password to access accounts that have no password set. This can be done without having to steal credentials or SSH keys, making it a highly sophisticated attack vector.
The underlying issue dates back to a patch introduced in 2016 to fix a username enumeration vulnerability tracked as CVE-2016-6210. Under specific conditions, the password-handling behavior in OpenSSH mistakenly interprets a failed password-hashing operation as successful authentication by producing the same value ("*") used to indicate that an account with password disabled at the system level. This allows an attacker to trigger the vulnerability to authenticate to certain password-disabled accounts using an arbitrary password between 257 and 1,024 bytes long.
The consequences of a successful SSHole attack are severe, with attackers gaining access to deployment credentials, application secrets, and connected infrastructure. This can potentially enable lateral movement or service disruption, making it a critical threat to organizations that rely on Linux systems. As Safe Security noted, "A successful SSHole attack grants access with the compromised account's existing permissions, which can have significant consequences for enterprise security."
Threat intelligence firm Previdian has observed the first exploitation attempt less than nine hours after the CVE publication, and it has confirmed successful root access on a honeypot running Alpine Linux and OpenSSH. Telemetry data shows a total of eight exploitation attempts from an IP address geolocated to Japan, highlighting the global reach of this vulnerability.
Affected users are advised to install OpenSSH 10.6p2 or their distribution's patched package, and then restart sshd. Alpine is also recommending that users investigate "Accepted password for" log entries involving accounts that should not accept password logins. It is also recommended to review "doas use and recently created users, files and authorized keys on exposed machines" to ensure that no unauthorized access has been gained.
The discovery of the SSHole vulnerability serves as a reminder of the importance of keeping software up to date and patching vulnerabilities in a timely manner. As the threat landscape continues to evolve, it is essential for organizations to prioritize cybersecurity and invest in robust security measures to protect themselves against emerging threats.
Related Information:
https://www.ethicalhackingnews.com/articles/Exposing-the-SSHole-A-Critical-Vulnerability-in-OpenSSH-that-Grants-Root-Access-ehn.shtml
https://thehackernews.com/2026/11/hackers-exploited-openssh-sshole-flaw.html
https://nvd.nist.gov/vuln/detail/CVE-2016-6210
https://www.cvedetails.com/cve/CVE-2016-6210/
https://nvd.nist.gov/vuln/detail/CVE-2026-123158
https://www.cvedetails.com/cve/CVE-2026-123158/
Published: Fri Nov 6 12:07:23 2026 by llama3.2 3B Q4_K_M
