sshhole (CVE-2026-123158): The Exploited OpenSSH Flaw That Opens Password-Less Accounts
CVSS 8.1 · HighEPSS 16.5% (97th)Actively exploitedIn CISA KEVPublic PoC
On November 5, 2026, the OpenSSH project shipped OpenSSH 10.6p2 to close a password authentication bypass in sshd. The flaw, tracked as CVE-2026-123158 and nicknamed “sshhole”, affects Linux systems that use the musl C library with PAM disabled, Alpine Linux being the best-known example. Under the right account configuration, an attacker who knows the name of a password-less account can log in with any password between 257 and 1,024 bytes long, within one SSH connection [1].
The flaw is already being exploited. CISA added CVE-2026-123158 to its Known Exploited Vulnerabilities (KEV) catalog on November 9, 2026, and Hong Kong’s HKCERT reports it as exploited in the wild. National CERTs in Ireland, Spain and Belgium have issued advisories.
Greenbone provides a remote version check and an active check. The version check flags older OpenSSH banners, but Alpine may have backported the fix without changing the advertised OpenSSH version. The active check can confirm the bypass for a username it tests; a negative result does not rule it out. Check the installed Alpine package revision and restart status when assessing exposure.
Start Your Free Trial
Find out which of your servers are exposed: the OPENVAS ENTERPRISE FEED includes a version check and an active check for CVE-2026-123158. Grab a copy of OPENVAS SCAN with a free two-week trial of the OPENVAS ENTERPRISE FEED to gain the deepest insight into where software vulnerabilities exist in your organization’s IT infrastructure.
How Greenbone Detects sshhole
Alpine Linux did not move every release to OpenSSH 10.6p2. It fixed older releases by patching the OpenSSH version they already ship. Alpine 3.21, for example, is fixed in package 9.9_p2-r1 and Alpine 3.20 in 9.7_p1-r6 [1]. A server that announces OpenSSH 9.9p2 can therefore be patched or unpatched. The version check flags candidates; the active check sends crafted requests to the SSH service and checks the responses.
Both checks are in the feed. Trigger a manual feed update to get them now.
Who Is Exposed
According to Alpine Linux, a system is exploitable only when all of the following are true:
- sshd runs without PAM: the
openssh-serverpackage, oropenssh-server-pamwithUsePAM no. PasswordAuthenticationis set toyes, which is the OpenSSH default.- At least one account has
*in its password field. Typical examples are key-only users, directory-service users (nslcd, winbind, sssd) and thealpineuser in tiny-cloud images. - At least one other local account has a
$5$or$6$password hash.
One account with a password hash is enough to make every otherwise SSH-eligible account with a * password field reachable [1]. Systems that are not affected include containers that don’t run sshd, servers with PasswordAuthentication no, openssh-server-pam with UsePAM yes, and accounts locked with ! [1]. Distributions built on glibc, such as Red Hat, SUSE, Ubuntu and Debian, are reported as not affected [1].
The official tiny-cloud images from 3.18.11 through 3.24.3 ship an alpine user with a * password and passwordless doas. They are safe on first boot, but once any $6$ hash exists on the machine, for example after an admin sets a console password, an attacker can log in as alpine and use doas to become root [1].
Risk Assessment
CVE-2026-123158 carries a CVSS 3.1 base score of 8.1 (High), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, assigned by the CNA (MITRE) [1]. It is classified as CWE-394: Unexpected Status Code or Return Value.
Exploitation followed disclosure quickly:
- CISA KEV: added November 9, 2026, with a remediation deadline of November 12, 2026 for US federal agencies [1].
- Honeypot data: the SANS Internet Storm Center recorded the first real exploit attempt on November 5, 2026, the day of disclosure. Attempts with unusually long passwords peaked at 713 on November 6 [1].
- Sensor data: Previdian saw its first attempt on November 6, 2026 at 00:05 UTC and counted 22 attempts from 14 IP addresses in 10 countries by November 10 [1].
- Public PoC: proof-of-concept code is publicly available [1][2].
Technical Details
The OpenSSH project considers the root cause to lie outside sshd, “but it is exploitable via sshd and can be avoided there” [1]. On musl, the password-hashing function returns * for an over-long password. sshd compares that result with the stored password field, and for an account whose field is *, the two match [1]. OpenSSH 10.6p2 adds a minimum-length check on the stored hash, so the comparison no longer succeeds. The musl maintainers describe the behaviour as “not a bug in musl just an erroneous use by the caller” [1].
The flaw was reported by Özgün Kültekin of Wakefield [1].
Affected Versions and Mitigation
Upstream, the fix is OpenSSH 10.6p2. On Alpine Linux, edge and releases 3.16 through 3.24 are affected, including releases that no longer get regular updates. The fixed openssh packages are [1]:
Tiny-cloud images built from the point releases 3.21.10, 3.22.8, 3.23.8, 3.24.4 and later include the fix.
- Patch and restart. Run
apk upgrade -U -a, then restart sshd. Alpine warns that “upgrading the package alone does not replace the running daemon.” - If you can’t patch yet, set
PasswordAuthentication noand restart sshd. Confirm withsshd -T | grep -i passwordauthentication, and test key-based login in a second session before you close the first one. - Check for past compromise. Search
/var/log/messagesforAccepted password foron accounts that have no password, such asalpine,rootor key-only users, and reviewdoasuse, new users, new files and authorized keys. If you can’t rule out a login, treat the system as compromised.
All three steps follow the Alpine Linux advisory.
Since Last Week
Brotli out-of-bounds write (CVE-2026-111497). We covered this flaw in Brotli, Cisco and Sophos: When Configuration Decides Exposure. This week the feed added checks for products that bundle the vulnerable decoder:
- Elastic Kibana Multiple Vulnerabilities (ESA-2026-232, ESA-2026-229, ESA-2026-203, Brotli2Shell, eMudhra): Version check
- SolarWinds Dameware Mini Remote Control < 2026.3.1 Multiple Vulnerabilities: Local registry check
- SolarWinds Dameware Remote Support < 2026.3.1 Multiple Vulnerabilities: Local registry check
New Checks This Week
Between November 5 and November 11, 2026, the feed team shipped 120 new product checks covering 267 CVEs from 30 vendors. These are the ones to look at first.
Barracuda Appliances: Command Injection Exploited (CVE-2026-111560)
CVSS 8.6 · HighEPSS 1.1% (65th)Actively exploitedIn CISA KEV
CVE-2026-111560 is an OS command injection in the timezone configuration field of several Barracuda appliances. An authenticated administrator can inject commands that run as root. CVSS 4.0 base score 8.6, assigned by the CNA (Mandiant) [1]. Barracuda says it has “identified exploitation activity affecting a small number of organizations” [1], and CISA added the CVE to KEV on November 10, 2026 [1].
The flaw affects Email Security Gateway (ESG), Load Balancer ADC, Web Application Firewall (WAF), Web Security Gateway (WSG), Message Archiver (BMA) and WAF Control Center (WCC). On ESG it can be chained with CVE-2026-116606, an authorization bypass, to gain root on the device. Barracuda lists a patch per product and recommends restricting administrative interfaces to trusted internal networks [1].
Checks for CVE-2026-111560:
- Barracuda Email Security Gateway <= 9.4.0.027 OS Command Injection Vulnerability: Version check
- Barracuda Web Application Firewall <= 12.3.0.011 Command Injection Vulnerability: Version check
- Barracuda Load Balancer <= 6.6.0.009 OS Command Injection Vulnerability: Version check
More Critical Flaws With New Checks
The four critical CVEs with new checks this week, each shown with its CVSS severity band and EPSS exploitation-probability score
ManageEngine ADSelfService Plus: remote code execution in the GINA client [CWE-78], fixed in build 7001 [1]. Check: Version check
JetBrains Hub: privilege escalation by changing email authentication details during verification [CWE-915], fixed in 2026.2.52556 [1]. Check: Version check
Sonatype Nexus Repository 3: disabled or locked users can sign in again through SAML or OIDC single sign-on [CWE-1390]; affects Nexus Repository 3 Pro versions 3.86.0 through 3.97.x, fixed in 3.98.0 [1]. Check: Version check
OpenNMS: unauthenticated REST API access through non-canonical HTTP method names [CWE-862], fixed in Horizon 36.0.5 and Meridian 2024.3.14, 2025.0.11 and 2026.0.1 [1]. Check: Version check
Summary
sshhole turns a convenience setting, password authentication left on next to key-only accounts, into a way in for anyone who knows a username. It is in CISA’s KEV catalog, honeypots saw exploit attempts on the day of disclosure, and a public PoC is available. Patch to OpenSSH 10.6p2 or the fixed Alpine package, restart sshd, and check your logs for logins you can’t explain. Because Alpine fixed older releases without changing their OpenSSH version number, run the active check as well as the version check to see which servers are still exposed.
Start Your Free Trial
Find out which of your servers are exposed: the OPENVAS ENTERPRISE FEED includes a version check and an active check for CVE-2026-123158. Grab a copy of OPENVAS SCAN with a free two-week trial of the OPENVAS ENTERPRISE FEED to gain the deepest insight into where software vulnerabilities exist in your organization’s IT infrastructure.
All New Checks Rated CVSS 8.0 or Higher
