SSHole exploitation reaches Alpine Linux root honeypot
Threat actors began attempting to exploit the OpenSSH vulnerability CVE-2026-123158, known as SSHole, less than nine hours after its public disclosure. Threat intelligence firm Previdian said it confirmed successful root access on an Alpine Linux honeypot running OpenSSH, while recording eight exploitation attempts from an IP address geolocated to Japan.
The flaw carries a CVSS score of 8.1 and was fixed in OpenSSH 10.6p2. It affects Linux hosts that combine OpenSSH with the musl C library and disabled Pluggable Authentication Modules (PAM), a configuration that includes Alpine Linux’s default OpenSSH server setup.
How SSHole authentication bypass works
SSHole can allow an unauthenticated attacker to sign in to an account configured without a usable password, without stealing a credential or SSH key. The attacker supplies an oversized password, between 257 and 1,024 bytes, to make the password-hashing operation fail under the affected conditions.
The failure is mistakenly treated as successful authentication because it produces an asterisk character, the same value used for an account whose password is disabled at the system level. When sshd compares that result with an asterisk in the account password field, the login succeeds.
Exploitation still requires at least one account with an asterisk as its password hash. It does not bypass passwords for accounts that have valid password hashes. The underlying behaviour traces back to a 2016 patch for CVE-2016-6210, an OpenSSH username-enumeration issue.
Observed activity and exposure limits
Previdian said the observed host used oversized passwords and executed the reconnaissance commands id, uname, and hostname through non-interactive SSH sessions. A successful SSHole login grants the permissions already assigned to the compromised account, which can be especially serious when that account is root.
The issue does not affect Dropbear, glibc-based Linux distributions, non-Linux systems, or systems that validate passwords through PAM. The operational danger also resembles the privilege boundary highlighted by container escape to host root, where a path to root on the underlying host turns a contained weakness into a broader infrastructure problem.
Patch and investigate exposed systems
OpenSSH users should install version 10.6p2 or the relevant distribution package update and restart sshd. Alpine advises administrators to inspect /var/log/messages for sshd records stating “Accepted password for” an account that should not permit password logins, including alpine, root, and key-only users.
Administrators should also review doas activity, recently created users, files, and authorized keys on exposed machines. If an unexpected login cannot be ruled out, Alpine recommends treating the system as compromised; for businesses, the immediate priority is to patch affected hosts, restart the service, and investigate authentication evidence before trusting connected credentials or infrastructure.