A newly disclosed OpenSSH vulnerability, CVE-2026-123158 (dubbed "SSHole"), allows unauthenticated attackers to log into accounts configured without passwords by supplying an oversized password string, exploiting a flaw in how the SSH daemon handles failed password-hashing operations on musl-based Linux systems like Alpine Linux. Threat actors began attempting to exploit the flaw within nine hours of its public disclosure, with researchers at Previdian confirming successful root access on a honeypot, tracing the attempts to an IP address geolocated to Japan. Affected users are urged to upgrade to OpenSSH 10.6p2 and audit their logs for unexpected successful password authentications on accounts that should not permit them.
