OpenSSH Remote Authentication Bypass (CVE‑2026‑123158) Exploited Within Hours
What It Is — A newly disclosed flaw in OpenSSH (CVE‑2026‑123158), dubbed “sshole,” allows an unauthenticated remote attacker to log into accounts that have no password hash (e.g., root or key‑only deploy users) on Alpine Linux and other musl‑based systems. The bug stems from OpenSSH reusing another account’s password salt when a user’s /etc/shadow entry contains a “*”, which musl’s crypt() returns for passwords longer than 256 bytes. An attacker can send a single oversized password string, bypass authentication, and obtain a root shell. The vulnerability was patched in OpenSSH 10.6p2 (released Nov 5 2026), but threat‑intel firm Previdian observed successful exploitation on a honeypot less than nine hours after public disclosure.
Affected Products — OpenSSH ≤ 10.6p2 on Alpine Linux and other musl‑based distributions.
Why It Matters for Trust & Control Assurance — This incident highlights the need for robust identity‑and‑access‑control safeguards and continuous verification that authentication mechanisms are correctly configured. Capability focus: ACCESS_CONTROLS.
Recommended Actions
- Upgrade OpenSSH to 10.6p2 or later on all affected hosts.
- Review SSH daemon configuration; disable password‑less logins or enforce strict key‑based authentication.
- Enable detailed SSH logging and feed events into a SIEM for real‑time detection.
- Conduct a control‑mapping exercise to confirm that your access‑control policies meet the relevant control objective.
Source: https://www.helpnetsecurity.com/2026/11/06/openssh-sshole-cve-2026-123158-exploitation/