OpenSSH “SSHole” (CVE‑2026‑123158) Enables Password‑less Root Access on Linux Systems
What It Is — A newly disclosed flaw in OpenSSH, identified as CVE‑2026‑123158 (codenamed sshole), receives a CVSS 8.1 rating. The vulnerability affects Linux hosts that run OpenSSH compiled against the musl C library while having Pluggable Authentication Modules (PAM) disabled. By exploiting the flaw, an attacker can authenticate to any local account that lacks a password, then leverage typical privilege‑escalation paths to obtain root. Within hours of the public advisory, threat‑actor groups were observed scanning the internet, successfully compromising a honeypot and achieving full system control. The vendor has issued a patch; administrators are urged to apply it immediately and re‑enable PAM where feasible.
Affected Products — OpenSSH (any version compiled with musl and PAM disabled).
Why It Matters for Trust & Control Assurance — The issue tests the access‑control control objective: ensuring authentication mechanisms enforce strong credential requirements. Capability focus: ACCESS_CONTROLS.
Recommended Actions — Deploy the OpenSSH security update, re‑enable PAM or enforce mandatory password policies, audit accounts for empty passwords, and enable logging of authentication attempts. Source: The Hacker News