Threat actors are attempting to exploit a recently disclosed security flaw impacting OpenSSH that can enable sign-ins to accounts that have no password set, according to Previdian.

The vulnerability, tracked as CVE-2026-123158 (CVSS score: 8.1) and codenamed SSHole (or *sshole), impacts Linux systems that run OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled, including Alpine Linux's default OpenSSH server configuration.

An unauthenticated attacker can supply an oversized password to access accounts that are deliberately configured without usable passwords, without having to steal credentials or SSH keys. The issue, discovered by security researcher Ozgun Kultekin, has been addressed in OpenSSH 10.6p2.

The underlying issue dates back to a patch introduced in 2016 to fix a username enumeration vulnerability tracked as CVE-2016-6210. Under specific conditions, the password-handling behavior in OpenSSH mistakenly interprets a failed password-hashing operation as successful authentication by producing the same value ("*") used to indicate that an account with password disabled at the system level.

An attacker can trigger the vulnerability to authenticate to certain password-disabled accounts using an arbitrary password between 257 and 1,024 bytes long, causing the hash attempt to fail and returning an asterisk. The sshd daemon then compares with the asterisk stored in the account's password field, leading to a successful login.

To be clear, successful exploitation requires at least one account with an asterisk (*) as its password hash. It does not allow attackers to bypass passwords on accounts with valid password hashes.

"A successful SSHole attack grants access with the compromised account's existing permissions," Safe Security said .

Source link