OpenSSH SSHole authentication flaw exploited in the wild

On November 5, 2026, a flaw called *sshole was described in OpenSSH on musl-based Linux systems. The issue could let attackers log into accounts that use an asterisk to block password logins by submitting a password over 256 bytes. The flaw affected Alpine Linux, OpenWrt, Buildroot and Yocto under certain configurations and dated to a 2016 patch for CVE-2016-6210. OpenSSH 10 fixed it, but Alpine's official AWS and Azure images included an affected default alpine account with doas privileges.

On November 6, 2026, an emergency OpenSSH 10.6p2 update addressed the flaw, called SSHole and tracked as CVE-2026-123158. The bug affected Linux systems using the musl C library and allowed remote attackers to bypass authentication on accounts with password login disabled. It could be triggered by sending a password of 257 to 1,024 characters. Alpine advised disabling password authentication and using keys.

Later on November 6, 2026, Previdian confirmed the flaw was exploited within nine hours of disclosure. The threat intelligence firm observed successful root access on a honeypot. The vulnerability stems from a misinterpretation of password hashes in systems where PAM-based authentication is disabled. The emergency 10.6p2 update had been released on November 5.