In a swift move, attackers are leveraging a newly revealed security flaw within OpenSSH, termed the SSHole vulnerability, to gain unauthorized access to accounts lacking password protection. This development, reported by threat intelligence firm Previdian, underscores the critical nature of the flaw.
Understanding the SSHole Vulnerability
The SSHole vulnerability, officially recognized as CVE-2026-123158 with a CVSS score of 8.1, primarily affects Linux systems that utilize OpenSSH on the musl C library, particularly when Pluggable Authentication Modules (PAM) are disabled. Alpine Linux’s default OpenSSH setup is among those at risk. Discovered by researcher Ozgun Kultekin, the flaw allows attackers to exploit an oversized password to access accounts with no set passwords. This issue has been addressed in the release of OpenSSH 10.6p2.
Technical Details and Exploitation
The origin of the vulnerability can be traced back to a 2016 fix for a username enumeration issue (CVE-2016-6210). Under specific conditions, OpenSSH’s password handling mistakenly validates failed password hashes as successful, using an asterisk (*) to denote an account without a password. Attackers can utilize passwords between 257 and 1,024 bytes to trigger this glitch, leading to unauthorized access.
Successful exploitation hinges on accounts having an asterisk as their password hash, preventing bypass of accounts with legitimate password hashes. However, once inside, attackers can operate with the compromised account’s permissions, posing significant risks to enterprise environments, including unauthorized access to sensitive credentials and potential lateral movement across networks.
Immediate Impacts and Mitigation
Previdian observed exploitation attempts immediately after the vulnerability’s disclosure, with confirmed root access on an Alpine Linux honeypot. The initial attack originated from a Japanese IP address, which executed reconnaissance commands via SSH. In response, users are urged to upgrade to OpenSSH 10.6p2 or apply their distribution’s patch, followed by a restart of the sshd service.
Alpine Linux advises users to scrutinize log entries for unauthorized password acceptances and to review recent changes to user credentials and authorized keys. Machines suspected of compromise should be treated with heightened security measures.
This incident highlights the need for proactive security updates and thorough monitoring to safeguard against emerging threats. As attackers continue to adapt, maintaining robust cybersecurity defenses becomes increasingly critical.
