Hackers exploit SSHole OpenSSH flaw to breach Linux systems

A vulnerability in OpenSSH, dubbed SSHole (CVE-2026-123158), is being exploited to break into some Linux systems, especially those using the musl library, including Alpine Linux deployments common in cloud and container environments. The flaw affects accounts whose password field is set to an asterisk to block password logins: an oversized password can trigger an error in musl’s password-hashing function that OpenSSH mistakenly accepts as a match. Exploitation depends on specific authentication settings, and accounts with valid password hashes are not affected. If the vulnerable account has passwordless administrative privileges, attackers may gain root access. OpenSSH fixed the flaw in version 10.6p2, released November 5, 2026.

Security firms observed exploitation beginning soon after public proof-of-concept code appeared. GreyNoise documented 16 successful attack chains from six IP addresses, including attempts to inspect systems and containers, query cloud metadata, obtain password hashes and root SSH keys, and add unauthorized SSH keys for continued access. One attacker obtained root privileges and installed a Python command-and-control tool called TAC Agent, though it failed to connect to its server. Other monitoring firms reported additional attempts, including activity linked to botnets and cryptomining. Administrators should upgrade OpenSSH promptly or disable SSH password authentication on affected systems, and investigate unexpected successful logins to asterisk-password accounts, unfamiliar SSH keys, and suspicious TAC Agent files or startup services.