Signal is active with 30 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
CVE-2026-123158 - SSHole - OpenSSH/musl Password Auth Bypass 🔥 Nuclei Template : https://github.com/projectdiscovery/nuclei-templates/pull/17702/changes Reference : https://sshhole.com/ #ssh #authbypass #hackwithautomation https://t.co/pXLiGEa2cO
Lady Gaga, CVE-2026-123158 (sshhole) açığını nereden biliyordu? https://x.com/ladygaga/status/266036172122365952
Just reproduced sshole (CVE-2026-123158), beautifully simple bug by @kultekin Needs password auth on and no PAM, but you can ssh as root into an unpatched Alpine box with any 257+ byte password. musl crypt() returns "*" for any password over 256 bytes. a locked account's shadow field is also "*". sshd compares them and they match. fix: openssh 10.6p2
OpenSSHのパスワード認証回避の脆弱性 CVE-2026-123158 についてまとめてみた - piyolog https://piyolog.hatenadiary.jp/entry/2026/11/06/120149
SSHOLE (CVE-2026-123158) live tracking. https://sshole.events.greynoise.io/
🚨 As expected, watchTowr Intel is observing exploitation of the OpenSSH Authentication Bypass “SSHole” (CVE-2026-123158). For now, it’s botnets and crypto miners. We’re interested in what happens next. https://t.co/Z9Nju3pJoP
ファクトチェック結果 脆弱性：CVE-2026-123158（通称 *sshole） 深刻度：CVSS 3.1：8.1（High） 公表日：2026年11月5日 影響対象：musl libcを使用し、PAMなしで動作するOpenSSHなど パスワード：任意の257～1,024バイト root権限：特定の構成で取得可能 修正版：OpenSSH 10.6p2、各ディストリビューションの修正パッケージ 参考情報： https://wakefield.co/research/openssh-musl-authentication-bypass https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/
パスワードを設定していないSSHアカウントに､ 257バイト以上の長いパスワードを送るだけでログインが成立する https://joho-todai.com/openssh-authentication-bypass-vulnerability-cve-2026-123158/ OpenSSH＋musl libc（Alpine Linux等が採用するCライブラリ）の組み合わせで見つかった認証回避の脆弱性CVE-2026-123158｡ CVSSv3.1基本値8.1 原因は2016年に導入されたタイミング攻撃対策にある アカウントの存在を応答時間から推測されないよう､パスワードハッシュがないアカウントでもダミーのハッシュ処理を行う仕組みを入れた musl libcのcrypt()は256バイト超の入力でエラー文字列「*」を返し､ パスワード未設定アカウントの保存値「*」と一致してしまう Debian・Ubuntu ･ Fedora等のglibc環境は影響を受けない OpenSSH 10.6p2で修正済み Alpine Linuxでは更新後にsshdの再起動が必要になる｡
注意，关于 CVE-2026-123158（sshhole）这个漏洞： 必须同时凑齐 musl libc + 无 PAM + 开密码登录 + 存在 * 账号 + 有 donor hash 五个条件。 一旦凑齐条件，利用成本为零。 Alpine 容器开 sshd 的场景尤其要注意。 修复方式：升 OpenSSH 10.6p2 + 重启 sshd 这个漏洞利用是"凑环境难"，一单条件满足"打起来容易"，目前 PoC 已公开，建议尽快升级。
GreyNoise is monitoring scanning, exploitation attempts, and successful exploitation of SSHole, an OpenSSH flaw affecting musl-based Linux systems like Alpine. CVE-2026-123158 (CVSS 8.1) is trivial to exploit and working exploits are publicly available. See what we’re observing in real time in our live activity report: https://hubs.la/Q04DFyj90
so far the only CVE-2026-123158 hit I've had in a honeypot is: ME
OpenSSHに認証バイパス脆弱性「*sshole（CVE-2026-123158）」 Alpine Linuxでパスワード不要のSSHログイン、root権限奪取のおそれ https://rocket-boys.co.jp/security-measures-lab/openssh-sshhole-cve-2026-123158-alpine-authentication-bypass/ #セキュリティ対策Lab #security #securitynews #セキュリティ #セキュリティニュース
عاجل، اليوم بدأ بالفعل استخدام الثغرة CVE-2026-123158 التي تم الكشف عنها بالأمس فقط في هجمات سيبرانية واسعة. الأمور تتطور بسرعة !
CVE-2026-123158 恐ろしいバグだなおい… ちな、RHEL系のディストリでは影響無い模様。
We’re now seeing SSHHole (CVE-2026-123158) exploited in the wild against OpenSSH. Evidence below 👇 Our first observed attempt came less than 9 hours after the CVE was published. We’ve confirmed successful password authentication bypasses and root logins on a Previdian honeypot running real Alpine Linux and OpenSSH. Timeline (all times UTC): - 5 November, 15:19: Added to Previdian Watch as VULN-2026-0006. - 5 November, 15:30: Previdian customers’ exposure status verified. - 5 November, 15:46: CVE-2026-123158 published. - 6 November, at around 00:15: Our first observed exploitation attempt. Observed source IP: 89.116.89[.]18. The source used non-interactive SSH sessions to execute reconnaissance commands, including id, uname and hostname. The vulnerability allows an oversized password to bypass authentication for certain accounts on affected musl-based Linux systems with PAM disabled and password authentication enabled. If affected, install OpenSSH 10.6p2 or your distribution’s patched package, then restart sshd. Further evidence 👇
Since yesterday, CVE-2026-123158(openssh auth bypass) has been actively exploited to distribute malicious samples. We have observed over 100 IP addresses attempting to exploit this vulnerability. https://t.co/4bOpfl7zof
"sshole" (CVE-2026-123158): OpenSSH anterior à 10.6p2 em Linux com musl (Alpine) sem PAM permite login em contas sem senha. Exploração começou em menos de 9h após a divulgação. Usa sshd em imagens Alpine? Atualize para 10.6p2. https://www.helpnetsecurity.com/2026/11/06/openssh-sshole-cve-2026-123158-exploitation/
🚨 SSHole is reportedly being exploited within hours of disclosure. CVE-2026-123158 affects OpenSSH before 10.6p2 on Linux with musl libc and no PAM. ExploitGrid 32.4 Monitor. Prioritize after actively exploited issues. Still patch. 🔎 https://exploitgrid.net/vulnerabilities/CVE-2026-123158?utm_source=x&utm_medium=social&utm_campaign=cve_alert
🚨During the past 24 hours, we have observed a small amount of actors targetting SSHole (CVE-2026-123158) Exploitation is not widespread yet, but is showing an early accelerating trend. Track exploit intelligence 👉https://console.defusedcyber.com/intel https://t.co/fhCpCN3iFk
https://github.com/Maalfer/CVE-2026-123158