An OpenSSH flaw tracked as CVE-2026-123158 has been actively exploited in the wild just hours after disclosure. Discovered by Wakefield security researcher Özgün Kültekin...
Tech consumers, gadget buyers, and developers using Alpine Linux and other musl-based systems are impacted by an actively exploited vulnerability, though a fix is available.
What broke and the current status
An OpenSSH flaw tracked as CVE-2026-123158 has been actively exploited in the wild just hours after disclosure. Discovered by Wakefield security researcher Özgün Kültekin and nicknamed SSHole (or *sshole), the critical vulnerability has existed for the past 10 years. The security bug carries a CVSS score of 8.1 and affects Linux systems running OpenSSH on the musl C library instead of glibc, particularly when Pluggable Authentication Modules (PAM) are disabled.
The vulnerability impacts lightweight Alpine Linux distributions widely used for cloud Docker container images, alongside Linux distributions built for embedded systems. Threat intelligence firm Previdian warned that threat actors are attempting to exploit the flaw to enable sign-ins to accounts that have no password set. According to the Alpine Linux team, an attacker who can reach an SSH port can log in without knowing any password using a single connection that works every time with no retries required.
Despite maintaining that the bug is not actually in their code, OpenSSH maintainers moved quickly to add mitigation for the flaw. The status of the vulnerability is fixed following the release of the OpenSSH 10.6p2 emergency update.
Verifying system exposure
Systems running OpenSSH servers on Linux distributions built with the musl C library instead of glibc with Pluggable Authentication Modules disabled are exposed to the vulnerability. The brief notes that the flaw allows remote attackers to bypass authentication and log into accounts that have password authentication disabled or lack a password entirely. Administrators must check whether their servers utilize musl-based environments such as Alpine Linux and whether remote attackers can reach their SSH port.
Mitigation steps and updates
Administrators must apply the emergency update released to address the security bug. The OpenSSH maintainers added mitigation for CVE-2026-123158 in the OpenSSH 10.6p2 emergency update. Beyond applying this specific patch, further deployment details or manual command sequences are not confirmed in the available sources.
Frequently Asked Questions
Q1: What is CVE-2026-123158?
CVE-2026-123158 is a critical OpenSSH vulnerability nicknamed SSHole that allows remote attackers to bypass authentication and log into passwordless accounts on musl-based systems.
Q2: Who discovered the flaw and when was it fixed?
The security bug was discovered by Wakefield security researcher Özgün Kültekin and fixed in OpenSSH 10.6p2 on November 5.
Q3: Which operating systems are impacted by the vulnerability?
The flaw impacts lightweight Alpine Linux distributions used for cloud Docker container images and Linux distributions for embedded systems that run OpenSSH on the musl C library with PAM disabled.