CVE-2026-123158: Detect & Patch OpenSSH SSHole Bypass

Executive Summary

A critical authentication bypass flaw in OpenSSH, tracked as CVE-2026-123158 and codenamed SSHole (or *sshole), is undergoing active exploitation in the wild less than nine hours following its public disclosure. Rated CVSS 3.1: 8.1 (High), the vulnerability allows unauthenticated remote attackers to gain instant root or administrative shell access to Linux systems running OpenSSH built against the musl C library with Pluggable Authentication Modules (PAM) disabled—most notably the default OpenSSH server deployment in Alpine Linux.

Discovered by security researcher Ozgun Kultekin and patched in OpenSSH 10.6p2, the flaw enables attackers to authenticate into accounts configured without usable passwords (such as root, alpine, or SSH key-only accounts) by submitting oversized password payloads. Threat intelligence telemetry from Previdian and GreyNoise confirmed successful in-the-wild root compromises on honeypots, with adversaries immediately running automated post-exploitation reconnaissance scripts, querying cloud metadata services, and deploying custom Python command-and-control agents like the TAC Agent.

---

Technical Vulnerability Analysis & Attack Chain

Root-Cause & Exploitation Mechanics

The root cause of CVE-2026-123158 stems from an unintended interaction between OpenSSH's legacy anti-enumeration protections and the cryptographic hashing behavior of musl libc:

1. The 2016 Anti-Enumeration Heritage (`CVE-2016-6210`): In 2016, OpenSSH introduced a timing mitigation to prevent attackers from determining valid usernames based on response delays. When an invalid user was requested, or when an account was disabled at the system level, the daemon executed a dummy hashing operation to equalize CPU consumption.
2. The Password-Disabled State in `/etc/shadow`: In standard Linux conventions, an account configured with no password or set for key-only access contains an asterisk (*) or exclamation mark (!) in the password hash field of /etc/shadow.
3. musl libc Buffer Limits on `crypt()`: When an attacker submits a password string between 257 and 1,024 bytes long during an SSH login attempt, musl libc's crypt() function encounters an internal length limit. Rather than processing the string, musl fails the hashing operation and returns an error representation value: an asterisk (*).
4. Faulty String Comparison Logic: OpenSSH's sshd authentication handler receives the return value of crypt(). Instead of recognizing the asterisk as a failure indicator from the C library, sshd treats the returned * as the legitimate computed hash. It then compares this returned * with the hash stored in /etc/shadow:

// Conceptual flaw representation in sshd authentication check
if (strcmp(computed_hash, shadow_hash) == 0) {
    auth_success(); // True when computed_hash == "*" and shadow_hash == "*"
}

1. Affected Scope Constraints: The vulnerability does not affect systems utilizing the standard GNU C Library (glibc, used by Debian, Ubuntu, RHEL, and Fedora) because glibc handles oversized password strings differently. It also does not impact installations that enforce password validation through PAM or use alternative daemons like Dropbear. However, lightweight container images, Kubernetes pods, and edge appliances based on Alpine Linux—which use musl libc without PAM—are directly vulnerable out of the box.

---

MITRE ATT&CK Tactics, Techniques & Procedures (TTPs)

---

Threat Actor Profile & Exploitation Telemetry

Telemetry captured by threat intelligence firms Previdian and GreyNoise observed active exploitation commencing less than nine hours following initial vulnerability disclosure. Threat actors deployed automated scanning harnesses targeting port 22 on public IPv4 ranges.

A honeypot running an unpatched Alpine Linux container with OpenSSH was compromised by an actor operating from IP address `89.116.89[.]18` (geolocated to Japan). Telemetry recorded eight distinct exploit attempts. Upon gaining root access via the oversized password payload, the adversary executed non-interactive reconnaissance commands, queried cloud metadata services, and attempted to deploy the TAC Agent—a Python command-and-control implant featuring shell command execution, file transfer capabilities, and automated persistence routines.

---

Detection & SOC Mitigation Playbook

1. Concrete Remediation & Workarounds

Organizations operating Alpine Linux containers, virtual machines, or appliances must take immediate protective action:

• Step 1: Upgrade OpenSSH Packages: Update to OpenSSH 10.6p2 or the latest distribution security release and restart the daemon:

# On Alpine Linux
pk update && apk upgrade openssh
c-service sshd restart

• Step 2: Disable Password Authentication (Immediate Mitigation): If packages cannot be immediately updated, disable password authentication entirely in /etc/ssh/sshd_config:

# Enforce key-only authentication
ed -i 's/^#*PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
ill -HUP $(pgrep -f sshd)

• Step 3: Harden Disabled Password Hashes in `/etc/shadow`: Ensure passwordless or disabled accounts use ! or !* rather than a standalone *:

# Check for vulnerable asterisk password fields
wk -F: '$2 == "*" {print $1}' /etc/shadow

# Lock accounts to prepend exclamation mark
asswd -l root

• Step 4: Audit Post-Exploitation Artifacts: Inspect compromised nodes for unauthorized changes to doas, sudo, and SSH keys, as well as unauthorized startup services linked to TAC Agent:

at /root/.ssh/authorized_keys
at /home/*/.ssh/authorized_keys
ind / -mmin -120 -type f 2>/dev/null | grep -E "(bin|etc|var)"

2. Network & Perimeter Defenses

• SSH Port 22 Restriction: Never expose OpenSSH listening ports directly to the public internet on container hosts or edge systems. Place administrative interfaces behind WireGuard, Tailscale, or corporate bastion jump hosts.
• Threat Actor IP Blocking: Block inbound connections from known scanning host `89.116.89[.]18` at perimeter firewalls.

3. Endpoint Detection & Hunting Query

Sigma Rule: OpenSSH Authentication Accepted for Disabled Account

title: OpenSSH Authentication Accepted for Passwordless Account
id: d7e21a48-52f1-43b9-a891-c918239048a1
status: experimental
description: Detects successful password authentication on OpenSSH for accounts that should not have a password configured (indicative of CVE-2026-123158 SSHole exploitation).
references:
  - https://thehackernews.com/2026/11/hackers-exploited-openssh-sshole-flaw.html?ref=cybernewsai.com
author: CyberNewsAI Threat Research Team
logsource:
  category: auth
  product: linux
detection:
  selection_accepted:
    message|contains: 'Accepted password for'
  selection_accounts:
    message|contains:
      - 'Accepted password for root'
      - 'Accepted password for alpine'
  condition: selection_accepted and selection_accounts
falsepositives:
  - Legitimate password authentication on systems where root or alpine has an explicitly assigned password (strongly discouraged).
level: critical
tags:
  - attack.initial_access
  - attack.t1190
  - attack.defense_evasion
  - attack.t1556

Microsoft Sentinel / Defender Hunting Query (KQL)

// Hunt for OpenSSH password authentication on root or service accounts on Linux endpoints
syslog
| where ProcessName == "sshd"
| where SyslogMessage has "Accepted password for"
| extend User = extract(@"Accepted password for (\S+)", 1, SyslogMessage),
         ClientIP = extract(@"from (\S+)", 1, SyslogMessage),
         Port = extract(@"port (\d+)", 1, SyslogMessage)
| where User in~ ("root", "alpine", "nobody", "daemon") or ClientIP == "89.116.89.18"
| project TimeGenerated, HostName, ProcessName, User, ClientIP, Port, SyslogMessage
| order by TimeGenerated desc

---