{"slug":"sshhole-openssh-musl-cve-2026-123158","title":"*sshole (CVE-2026-123158)","shortName":"*sshole","summary":"Confirmed exploited (CISA KEV, 9 Nov 2026). GreyNoise recorded first successful exploitation at 00:46 UTC on 7 Nov 2026 (16 exploitation chains; one TAC Agent implant with C2 tac.vpnla[.]org), as reported by BleepingComputer. Defused reported small-scale activity. SANS ISC Cowrie honeypots saw the first sshole exploit attempts on 5 Nov 2026, earlier than Previdian on 6 Nov. Previdian via Help Net Security: eight attempts from one Japan-based IP with successful root on one Alpine Linux/OpenSSH honeypot, while Previdian's live record (fetched 6 Nov 2026) lists attempts from 3 IPs (CH, JP, SG) and does not show success. Do not merge that single-sensor record with watchTowr, GreyNoise, or ISC. Password authentication bypass in Portable OpenSSH sshd on musl Linux when PAM is off, so an account whose shadow field is exactly * can accept an oversized password and get an SSH shell (CVE-2026-123158, MITRE CNA CVSS 3.1 8.1). Alpine gives 257 to 1024 bytes and the researcher and The Register 257 to 1,024 characters; the CVE record says 256 to 1024 characters. Fixed in Portable OpenSSH 10.6p2 and Alpine openssh packages on every branch from 3.16. Help Net Security, Previdian's CVE record, and watchTowr do not publish victim counts. ISC reports honeypot attempts, not production compromises. CISA listed CVE-2026-123158 in KEV on 9 Nov 2026 (catalog 2026.11.09, due 12 Nov 2026; ransomware use Unknown; CWE-394). Researcher-hosted interactive labs are public on sshhole.com.","isExample":false,"draft":false,"family":"sshhole-openssh-musl-cve-2026-123158","kind":"shared-component","aliases":["CVE-2026-123158","sshhole","SSHhole","*sshole","OpenSSH musl password bypass"],"publishedAt":"2026-11-05","updatedAt":"2026-11-10","patchStatus":"patched","exploited":true,"scores":{"cve":"CVE-2026-123158","cvss":{"cve":"CVE-2026-123158","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1","scorer":"cna","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-123158","sourceDate":"2026-11-05","checkedDate":"2026-11-05","dateLabel":"CNA published","sourceLabel":"MITRE CNA (CVSS 3.1 8.1). NVD API 5 Nov 2026: Received, Secondary CNA metric; no NVD-produced Primary.","nvdPublishedDate":"2026-11-05"},"epss":{"cve":"CVE-2026-123158","score":null,"percentile":null,"date":null,"sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-123158","checkedDate":"2026-11-05"},"kev":{"cve":"CVE-2026-123158","listed":true,"dateAdded":"2026-11-09","dueDate":"2026-11-12","catalogVersion":"2026.11.09","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-11-09"},"addedDate":"2026-11-05"},"priority":{"label":"act-now"},"managementSummary":{"what":"Password authentication bypass in Portable OpenSSH sshd on musl Linux when PAM is off (CVE-2026-123158, MITRE CNA CVSS 3.1 8.1). An account whose shadow field is exactly * can accept an oversized password and get an SSH shell. Alpine tiny-cloud images can then reach root through passwordless doas. CISA listed it in KEV on 9 Nov 2026 (due 12 Nov 2026; ransomware use Unknown; forensic triage required; CWE-394). GreyNoise recorded first successful exploitation at 00:46 UTC on 7 Nov 2026 (16 chains; one TAC Agent C2 tac.vpnla[.]org), as reported by BleepingComputer. Defused reported small-scale activity. SANS ISC reported honeypot attempts beginning 5 Nov 2026; Previdian and watchTowr reported exploitation on 6 Nov 2026; watchTowr reports botnet and cryptominer activity. Previdian's honeypot evidence stays single-sensor.","action":"Upgrade to Portable OpenSSH 10.6p2 or the Alpine package for your branch, then restart sshd. Until then, set PasswordAuthentication no (and KbdInteractiveAuthentication no) after you confirm key login works, and run sshd -t. Rebuild images that install openssh-server. Remove sshd from containers that do not need it. CISA KEV due date is 12 Nov 2026 for FCEB agencies. CISA marks forensic triage required: hunt Accepted password for accounts that should never take one, unauthorized SSH keys, and DNS or proxy logs for tac.vpnla[.]org."},"seenInTheWild":[{"metric":"exploitation-confirmed","value":"Listed","observer":"CISA","date":"2026-11-09","method":"CISA KEV catalog 2026.11.09, released 2026-11-09T16:16:16.4275Z, dateAdded 2026-11-09, due 2026-11-12, knownRansomwareCampaignUse Unknown, forensicTriage Yes, CWE-394. vulnerabilityName: OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability.","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"},{"metric":"third-party-stated","value":"First successful exploitation 7 Nov 2026 00:46 UTC; 16 exploitation chains; one TAC Agent implant with C2 tac.vpnla[.]org","observer":"GreyNoise","date":"2026-11-07","method":"BleepingComputer (Bill Toulas, 9 Nov 2026) quoting GreyNoise. First successful exploitation at 00:46 UTC on 7 Nov 2026. 16 exploitation chains. One attacker gained root and installed TAC Agent (Python C2) aimed at tac.vpnla[.]org. Single reported indicator, not a complete IOC set. Not a CISA statement.","sourceUrl":"https://www.bleepingcomputer.com/news/security/hackers-exploit-sshole-openssh-flaw-to-breach-linux-systems/"},{"metric":"third-party-stated","value":"Small-scale activity, not widespread","observer":"Defused","date":"2026-11-09","method":"BleepingComputer (Bill Toulas, 9 Nov 2026) quoting Defused: a small amount of actors trying to exploit SSHole, not widespread. Not a CISA statement.","sourceUrl":"https://www.bleepingcomputer.com/news/security/hackers-exploit-sshole-openssh-flaw-to-breach-linux-systems/"},{"metric":"third-party-stated","value":"First sshole exploit attempts on 5 Nov 2026; long-password attempts 232 / 713 / 246 / 51 on 5-8 Nov","observer":"SANS ISC honeypots","date":"2026-11-05","method":"SANS ISC diary by Johannes Ullrich (published 8 Nov 2026, last updated 2026-11-08 15:44:33 UTC): ISC Cowrie honeypots saw the first actual sshole exploit attempts on 5 Nov 2026, earlier than Previdian's first-observed attempt on 6 Nov. Long-password attempts: 232 on 5 Nov, 713 on 6 Nov, 246 on 7 Nov, 51 on 8 Nov. Long passwords seen on 1 Nov were judged not related to this exploit (buggy brute-force scripts). Cowrie keeps only the first 255 password characters, which limits attribution. These are honeypot attempts, not production compromises. Badge: Reported exploited. Not a vendor or CISA listing. Do not merge this with Previdian or watchTowr.","sourceUrl":"https://isc.sans.edu/diary/Scans+for+Sshole+Vulnerability+CVE2026123158/33498"},{"metric":"third-party-stated","value":"Successful root on one Alpine Linux/OpenSSH honeypot; eight attempts from 89.116.89[.]18","observer":"Previdian","date":"2026-11-06","method":"Help Net Security (6 Nov 2026) quotes Previdian founder Ryan Dewhurst: the first observed attempt arrived less than nine hours after CVE publication, and Previdian saw successful root access on a honeypot running real Alpine Linux and OpenSSH. Eight attempts, all from 89.116.89[.]18, described as Japan-based, all on one sensor. Recon: id, uname, hostname through non-interactive SSH sessions. Badge: Reported exploited. Not a vendor or CISA listing. The IP alone is not proof of compromise. Do not merge this single-sensor record with watchTowr.","sourceUrl":"https://www.helpnetsecurity.com/2026/11/06/openssh-sshole-cve-2026-123158-exploitation/"},{"metric":"third-party-stated","value":"Observing exploitation; for now, botnets and crypto miners","observer":"watchTowr","date":"2026-11-06","method":"watchTowr Intel posted at 09:28 UTC on 6 Nov 2026 (17:28 SGT) that it is observing exploitation of SSHole (CVE-2026-123158). The post says: for now, it's botnets and crypto miners. Security.NL (6 Nov 2026) reports the same watchTowr observation. Separate from Previdian's honeypot. No victim counts, IOCs, or campaign names published in those sources. Badge: Reported exploited. Not a vendor or CISA listing.","sourceUrl":"https://www.security.nl/posting/960618"},{"metric":"third-party-stated","value":"No indication that vulnerable systems have been exploited as of 5 Nov 2026","observer":"The Register","date":"2026-11-05","method":"Superseded 6 Nov 2026 by the Previdian/Help Net Security report. The Register (5 Nov 2026, 18:29 UTC) writes there is no indication vulnerable systems have been exploited. BleepingComputer's 5 Nov report does not describe in-the-wild use. That is a 5 Nov check, not a first-seen exploitation day. Badge at the time: No known ITW.","sourceUrl":"https://www.theregister.com/security/2026/11/05/get-root-on-a-musl-linux-system-by-slamming-it-with-an-overly-long-password/5307910"}],"seenInTheWildLinks":[{"title":"Known Exploited Vulnerabilities Catalog","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","observer":"CISA","metric":"exploitation-confirmed"},{"title":"Hackers exploit SSHole OpenSSH flaw to breach Linux systems","url":"https://www.bleepingcomputer.com/news/security/hackers-exploit-sshole-openssh-flaw-to-breach-linux-systems/","observer":"BleepingComputer","metric":"third-party-stated"},{"title":"Scans for Sshole Vulnerability (CVE-2026-123158)","url":"https://isc.sans.edu/diary/Scans+for+Sshole+Vulnerability+CVE2026123158/33498","observer":"SANS ISC","metric":"third-party-stated"},{"title":"Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot","url":"https://thehackernews.com/2026/11/hackers-exploited-openssh-sshole-flaw.html","observer":"The Hacker News","metric":"third-party-stated"},{"title":"Misbruik OpenSSH-lek gemeld: 'Voorlopig botnets en cryptominers'","url":"https://www.security.nl/posting/960618","observer":"Security.NL","metric":"third-party-stated"},{"title":"watchTowr Intel observing SSHole exploitation","url":"https://x.com/watchtowrcyber/status/2118636513739317525","observer":"watchTowr","metric":"third-party-stated"},{"title":"OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158)","url":"https://www.helpnetsecurity.com/2026/11/06/openssh-sshole-cve-2026-123158-exploitation/","observer":"Help Net Security","metric":"third-party-stated"},{"title":"CVE-2026-123158 Exploitation Attempts Observed - OpenSSH","url":"https://previdian.com/CVE-2026-123158","observer":"Previdian","metric":"third-party-stated"},{"title":"Get root on a musl Linux system by slamming it with an overly long password","url":"https://www.theregister.com/security/2026/11/05/get-root-on-a-musl-linux-system-by-slamming-it-with-an-overly-long-password/5307910","observer":"The Register","metric":"third-party-stated"},{"title":"OpenSSH flaw lets attackers log into password-disabled Linux accounts","url":"https://www.bleepingcomputer.com/news/security/openssh-flaw-lets-attackers-log-into-password-disabled-linux-accounts/","observer":"BleepingComputer","metric":"third-party-stated"}],"whatChanged":{"date":"2026-11-10","items":[{"text":"CISA added CVE-2026-123158 (OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability) to the Known Exploited Vulnerabilities catalog on 9 Nov 2026 (catalog 2026.11.09, released 2026-11-09 16:16 UTC). dateAdded 2026-11-09, dueDate 2026-11-12. knownRansomwareCampaignUse Unknown. forensicTriage Yes. CWE-394. Badge is now confirmed exploited (KEV). First-seen stays SANS ISC honeypot attempts on 5 Nov 2026.","headline":"CISA listed CVE-2026-123158 in KEV; status is now confirmed exploited","section":"exploitation","date":"2026-11-10","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","alsoSourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","addedDate":"2026-11-10"},{"text":"BleepingComputer (Bill Toulas, 9 Nov 2026) quoting GreyNoise: first successful exploitation at 00:46 UTC on 7 Nov 2026; 16 exploitation chains; one TAC Agent implant with C2 tac.vpnla[.]org. Defused reported small-scale activity. The C2 is a single reported indicator via BleepingComputer/GreyNoise, not a complete IOC set.","headline":"GreyNoise recorded first successful exploitation on 7 Nov plus C2 tac.vpnla[.]org","section":"exploitation","date":"2026-11-10","sourceUrl":"https://www.bleepingcomputer.com/news/security/hackers-exploit-sshole-openssh-flaw-to-breach-linux-systems/","addedDate":"2026-11-10"},{"text":"Vendor statements dated 6 Nov 2026: Synology-SA-26:16, none of Synology's products are affected. Hillstone StoneOS series not affected (glibc-based; products do not use OpenSSH password authentication logic). Studio Network Solutions EVO not affected (no musl; SSH disabled by default). NetApp NTAP-20261106-0011 is Interim with no product verdict yet (investigating), not a not-affected mark.","headline":"Synology, Hillstone, and SNS EVO not affected; NetApp still investigating","section":"fixed-versions","date":"2026-11-10","sourceUrl":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_16","alsoSourceUrl":"https://security.netapp.com/advisory/ntap-20261106-0011","addedDate":"2026-11-10"},{"text":"SANS ISC diary (Johannes Ullrich, published 8 Nov 2026, last updated 2026-11-08 15:44:33 UTC): Cowrie honeypots saw the first sshole exploit attempts on 5 Nov 2026, earlier than Previdian's first-observed attempt on 6 Nov. Long-password attempts: 232 on 5 Nov, 713 on 6 Nov, 246 on 7 Nov, 51 on 8 Nov. Long passwords seen on 1 Nov were judged not related to this exploit (buggy brute-force scripts). Cowrie keeps only the first 255 password characters, which limits attribution. These are honeypot attempts, not production compromises. Badge stays Reported exploited.","headline":"SANS ISC Cowrie honeypots saw sshole attempts from 5 Nov 2026","section":"exploitation","date":"2026-11-09","sourceUrl":"https://isc.sans.edu/diary/Scans+for+Sshole+Vulnerability+CVE2026123158/33498","addedDate":"2026-11-09"},{"text":"Detection now also points at SSH server authentication logs (sshd/auth.log or journald): look for abnormally long password attempts and correlate with accepted password logins to accounts that should not accept passwords, especially accounts whose shadow password field is *. Added the top five SANS ISC scanner IPs, defanged, labelled low-fidelity scanner/source telemetry. The five are not complete coverage; the diary lists 18 initial scanner source IPs. The IPs alone are not proof of compromise. Fix guidance and the PoC index are unchanged.","headline":"Detection adds long-password sshd logs and top five ISC scanner IPs","section":"detection","date":"2026-11-09","sourceUrl":"https://isc.sans.edu/diary/Scans+for+Sshole+Vulnerability+CVE2026123158/33498","addedDate":"2026-11-09"},{"text":"Rechecked 9 Nov 2026: CVE-2026-123158 is not in CISA KEV (catalog 2026.11.06, released 2026-11-06T19:44:45.1797Z, 1,769 entries). Badge stays Reported exploited. That is public research, not a vendor or CISA listing. Previdian listed it on its own known-exploited feed; that feed is not CISA KEV.","headline":"Still Reported exploited; not in CISA KEV (catalog 2026.11.06, checked 9 Nov 2026)","section":"exploitation","date":"2026-11-09","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","alsoSourceUrl":"https://previdian.com/feed","addedDate":"2026-11-09"},{"text":"watchTowr Intel (6 Nov 2026, 09:28 UTC / 17:28 SGT) reports observing SSHole exploitation; for now, it's botnets and crypto miners. Security.NL (6 Nov 2026) reports the same watchTowr observation; Previdian's honeypot stays single-sensor and is not merged with it.","headline":"watchTowr reports SSHole exploitation; for now botnets and crypto miners","section":"exploitation","date":"2026-11-07","sourceUrl":"https://www.security.nl/posting/960618","alsoSourceUrl":"https://x.com/watchtowrcyber/status/2118636513739317525","addedDate":"2026-11-07"},{"text":"Superseded 9 Nov 2026 by the catalog 2026.11.06 recheck. Rechecked 7 Nov 2026: CVE-2026-123158 was not in CISA KEV (catalog 2026.11.06, released 2026-11-06T19:44:45.1797Z, 1,769 entries). Previdian listed it on its own known-exploited feed; that feed is not CISA KEV.","headline":"Superseded: 7 Nov KEV recheck against catalog 2026.11.06","section":"exploitation","date":"2026-11-07","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","alsoSourceUrl":"https://previdian.com/feed","addedDate":"2026-11-07"},{"text":"Help Net Security (6 Nov 2026) quotes Previdian founder Ryan Dewhurst: sensors picked up attacks, and at least one got all the way in. Dewhurst said the first observed attempt arrived less than nine hours after CVE publication, and Previdian saw successful root access on a honeypot running real Alpine Linux and OpenSSH. The source IP 89.116.89[.]18 used oversized passwords and ran id, uname, and hostname through non-interactive SSH sessions. So far, eight attempts, all from that single Japan-based address, all caught by one sensor. Previdian's live CVE record (fetched 6 Nov 2026) lists attempts from 3 IPs (CH, JP, SG) on 1 sensor and says sensors do not show the target was vulnerable or that the attempt succeeded. Live attempt totals on that page have moved between fetches on the same day, so this page does not cite a precise Previdian attempt count. Badge: Reported exploited. That is public research, not a vendor or CISA listing. Help Net Security and Previdian's CVE record do not describe compromised production systems or widespread attacks.","headline":"Reported exploited on one Previdian honeypot, not production","section":"exploitation","date":"2026-11-06","sourceUrl":"https://www.helpnetsecurity.com/2026/11/06/openssh-sshole-cve-2026-123158-exploitation/","alsoSourceUrl":"https://previdian.com/CVE-2026-123158","addedDate":"2026-11-06"},{"text":"Superseded 7 Nov 2026 by the catalog 2026.11.06 recheck. Rechecked 6 Nov 2026: CVE-2026-123158 was not in CISA KEV (catalog 2026.11.04, released 2026-11-04T20:00:05.774Z, 1,768 entries). Previdian listed it on its own known-exploited feed (Sensors First, 2026-11-06 09:53 UTC). That feed is not CISA KEV. Do not treat a Previdian listing as a CISA catalog row.","headline":"Superseded: 6 Nov KEV recheck against catalog 2026.11.04","section":"exploitation","date":"2026-11-06","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","alsoSourceUrl":"https://previdian.com/feed","addedDate":"2026-11-06"},{"text":"Detection still hunts sshd Accepted password lines for accounts meant to be password-disabled, correlated with session and process activity after the login, from /var/log/messages or the central sshd auth store (Alpine, 5 Nov 2026). Added reported attack-source telemetry from one honeypot: 89.116.89[.]18 (Previdian via Help Net Security, 6 Nov). The IP alone is not proof of compromise. Help Net Security describes it as Japan-based; that is infrastructure geolocation, not actor attribution. Help Net Security says proof-of-concept exploits have been posted on GitHub; Previdian cautions they are unverified and could contain malware. This page does not index those links. PoC badge unchanged: Public demo (auth bypass) for sshhole.com.","headline":"Honeypot source IP added to Detection; PoC index unchanged","section":"detection","date":"2026-11-06","sourceUrl":"https://www.helpnetsecurity.com/2026/11/06/openssh-sshole-cve-2026-123158-exploitation/","alsoSourceUrl":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/","addedDate":"2026-11-06"},{"text":"New catalog page for *sshole / sshhole (CVE-2026-123158).","headline":"New catalog page for *sshole CVE-2026-123158","section":"overview","date":"2026-11-05","kind":"page"},{"text":"Portable OpenSSH 10.6p2 (5 Nov 2026) ships a workaround for sshd on musl Linux with PAM disabled. Alpine published fixed openssh packages the same day: edge 10.6_p2-r0; 3.24 10.3_p1-r2; 3.23 10.2_p1-r1; 3.22 10.0_p1-r11; 3.21 9.9_p2-r1; 3.20 9.7_p1-r6; 3.19 9.6_p1-r3; 3.18 9.3_p2-r4; 3.17 9.1_p1-r7; 3.16 9.0_p1-r6. Point releases 3.21.10, 3.22.8, 3.23.8, and 3.24.4 ship the fix. Restart sshd after the package upgrade. MITRE CNA CVE-2026-123158 (published 15:46 UTC) scores CVSS 3.1 8.1. Alpine's advisory said no CVE had been assigned at the time of writing.","headline":"OpenSSH 10.6p2 and Alpine packages are the fix","section":"fixed-versions","date":"2026-11-05","sourceUrl":"https://www.openssh.org/txt/release-10.6p2","alsoSourceUrl":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/"},{"text":"Superseded 6 Nov 2026 by the Previdian/Help Net Security report. As of 5 Nov 2026, The Register (18:29 UTC) wrote there was no indication vulnerable systems had been exploited. BleepingComputer's 5 Nov report did not describe in-the-wild use. Badge at the time: No known ITW. Researcher-hosted interactive labs are public at sshhole.com (Özgün Kültekin / Wakefield). Not in CISA KEV (catalog 2026.11.04, checked 5 Nov 2026).","headline":"Superseded: no known ITW as of 5 Nov; labs public; not in KEV","section":"exploitation","date":"2026-11-05","sourceUrl":"https://www.theregister.com/security/2026/11/05/get-root-on-a-musl-linux-system-by-slamming-it-with-an-overly-long-password/5307910","alsoSourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},"whatTheBugIs":"CVE-2026-123158 is a password authentication bypass in Portable OpenSSH sshd on Linux when sshd is linked against musl libc and PAM is off. MITRE published the CVE at 15:46 UTC on 5 Nov 2026 (reserved the same minute). CNA score: CVSS 3.1 8.1 High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). CWE-394. NVD API (checked 5 Nov 2026): vulnStatus Received, published 16:17 UTC, lastModified 18:17 UTC. Secondary CNA metric only; no NVD-produced Primary. FIRST EPSS had no row on 5 Nov 2026.\n\nOpenSSH 10.6p2 (5 Nov 2026) calls this a critical security workaround for Linux systems that use musl libc with PAM disabled. The project says the root cause sits outside sshd, but the bypass is reachable through sshd and can be avoided there. Alpine (5 Nov 2026): when sshd is built without PAM it hashes a password attempt with crypt() and compares the result to the stored field. For a field too short to hold a salt, sshd borrows another account's salt. musl crypt() returns * when the key is over 256 bytes. * is also the stored field for accounts with no password, so the comparison succeeds. This page stays high level. It does not give password-construction detail beyond an oversized password.\n\nA host is in scope only when every precondition holds, from Alpine and the researcher. sshd is musl-linked. PAM is off (Alpine openssh-server default, or UsePAM no). PasswordAuthentication is yes (OpenSSH default unless changed). An account that can log in has shadow field exactly *. Another local account has a $5$ or $6$ hash. Network reach to the SSH port. Alpine gives 257 to 1024 bytes and the researcher and The Register 257 to 1,024 characters; the CVE record says 256 to 1024 characters. Both wordings are dated 5 Nov 2026. Locked accounts with ! are out of Alpine's scope. OpenSSH's default PermitRootLogin prohibit-password keeps root from a password login unless that setting is yes; Alpine notes that does not help if another reachable account can become root, for example through doas.\n\nFix: Portable OpenSSH 10.6p2, and Alpine's backported packages on every branch from 3.16 (table below). Upgrading the package does not replace a running sshd. Alpine: apk upgrade -U -a, then rc-service sshd restart. Point releases 3.21.10, 3.22.8, 3.23.8, and 3.24.4 ship the fix. Alpine 3.21 reached end of support on 1 Nov 2026. Alpine still published fixed packages for each release back to 3.16, including 3.16 to 3.20. Alpine's advisory said no CVE identifier had been assigned at the time of writing. The MITRE record landed later the same day.\n\nExploitation: Help Net Security (6 Nov 2026) quotes Previdian founder Ryan Dewhurst: sensors picked up attacks, and at least one got all the way in. Dewhurst said the first observed attempt arrived less than nine hours after CVE publication, and Previdian saw successful root access on a honeypot running real Alpine Linux and OpenSSH. Source IP 89.116.89[.]18 (described as Japan-based) used oversized passwords and ran id, uname, and hostname through non-interactive SSH sessions. Eight attempts, all from that address, all on one sensor. Previdian's live CVE record (fetched 6 Nov 2026) lists attempts from 3 IPs (CH, JP, SG) on 1 sensor and says sensors do not show the target was vulnerable or that the attempt succeeded. Live attempt totals on that page have moved between fetches on the same day, so this page does not cite a precise Previdian attempt count. The Hacker News (6 Nov 2026) recaps that Previdian report with the same less-than-nine-hours wording. watchTowr Intel (6 Nov 2026, 09:28 UTC / 17:28 SGT) separately reports observing exploitation; the post says: for now, it's botnets and crypto miners. Security.NL (6 Nov 2026) reports the same watchTowr observation. Do not merge Previdian's single-sensor honeypot with watchTowr. SANS ISC (Johannes Ullrich, diary published 8 Nov 2026, last updated 2026-11-08 15:44:33 UTC) reports that ISC Cowrie honeypots saw the first sshole exploit attempts on 5 Nov 2026, earlier than Previdian's first-observed attempt on 6 Nov. Long-password attempts: 232 on 5 Nov, 713 on 6 Nov, 246 on 7 Nov, 51 on 8 Nov. Long passwords seen on 1 Nov were judged not related to this exploit (buggy brute-force scripts). Cowrie keeps only the first 255 password characters, which limits attribution. These are honeypot attempts, not production compromises. SANS Stormcast on 9 Nov 2026 is related coverage of that diary. BleepingComputer (Bill Toulas, 9 Nov 2026) quoting GreyNoise: first successful exploitation at 00:46 UTC on 7 Nov 2026; 16 exploitation chains; one TAC Agent implant with C2 tac.vpnla[.]org. Defused reported small-scale activity, not widespread. This page does not publish victim counts or campaign names from the Previdian or watchTowr reports. The C2 is a single reported indicator via BleepingComputer/GreyNoise, not a complete IOC set. Badge: confirmed exploited (CISA KEV, 9 Nov 2026). The Register (5 Nov 2026, 18:29 UTC) had written there was no indication vulnerable systems had been exploited; that 5 Nov check is superseded. CISA listed CVE-2026-123158 in KEV on 9 Nov 2026 (catalog 2026.11.09, released 2026-11-09T16:16:16.4275Z, due 12 Nov 2026; knownRansomwareCampaignUse Unknown; forensicTriage Yes; CWE-394). Previdian listed the CVE on its own known-exploited feed (Sensors First, 2026-11-06 09:53 UTC); that feed is not CISA KEV. CISA ADP (17:18 UTC on 5 Nov) tagged sshhole.com as an exploit reference and set SSVC Exploitation to poc. That is a PoC assessment, not an in-the-wild mark. Help Net Security says proof-of-concept exploits have been posted on GitHub; Previdian cautions they are unverified and could contain malware. This page does not index those links. Researcher-hosted interactive labs remain public at sshhole.com. This page indexes that lab only and does not copy exploit code.\n\nCredit: Özgün Kültekin (Wakefield) reported it. OpenSSH credits that report. Alpine thanks Damien Miller and Darren Tucker for the fix and the 10.6p2 release, Timo Teräs for analysis help, and Natanael Copa for the packages.","attackPath":{"caption":"High-level only. Not a reproduction guide. No password-construction detail beyond an oversized password.","steps":[{"id":"reach","label":"Reach sshd","detail":"Network access to a host running Portable OpenSSH sshd. Alpine: one connection is enough when the rest of the preconditions hold."},{"id":"app","label":"Password path open","detail":"sshd is musl-linked, PAM is off, and PasswordAuthentication is yes. Alpine's default openssh-server package is built that way."},{"id":"unsafe","label":"Oversized password","detail":"The attempt targets an account whose shadow field is exactly *, while another local account has a $5$ or $6$ hash. Conceptual impact class only."},{"id":"exec","label":"Login accepted","detail":"sshd accepts the password for an account that should never take one. Alpine: alpine, root (if PermitRootLogin yes), or any key-only user with *."},{"id":"shell","label":"SSH shell","detail":"The session is an SSH shell. Alpine tiny-cloud: the alpine user has passwordless doas, so that shell can become root."}]},"exploitation":{"kev":{"listed":true,"date":"2026-11-09","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"CISA listed CVE-2026-123158 (OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability) on 9 Nov 2026, due 12 Nov 2026. Catalog 2026.11.09 (released 2026-11-09T16:16:16.4275Z). knownRansomwareCampaignUse Unknown. forensicTriage Yes. CWE-394. Verified 9 Nov 2026."},"firstSeen":{"date":"2026-11-05","source":"SANS ISC honeypots","note":"Confirmed exploited (CISA KEV, 9 Nov 2026). First-seen stays SANS ISC Cowrie honeypot attempts on 5 Nov 2026, earlier than Previdian's first-observed attempt on 6 Nov. Long-password attempts: 232 on 5 Nov, 713 on 6 Nov, 246 on 7 Nov, 51 on 8 Nov. Long passwords seen on 1 Nov were judged not related to this exploit (buggy brute-force scripts). Cowrie keeps only the first 255 password characters, which limits attribution. These are honeypot attempts, not production compromises. BleepingComputer (9 Nov 2026) quoting GreyNoise: first successful exploitation at 00:46 UTC on 7 Nov 2026. Previdian via Help Net Security (6 Nov 2026) reported successful root on one Alpine Linux/OpenSSH honeypot. watchTowr Intel the same day reports observing exploitation; for now, it is botnets and crypto miners. OpenSSH and Alpine have not stated in-the-wild use."},"vendorStatements":[{"vendor":"CISA","date":"2026-11-09","statement":"CISA KEV catalog 2026.11.09 (released 2026-11-09T16:16:16.4275Z) lists CVE-2026-123158. vulnerabilityName: OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability. dateAdded 2026-11-09. dueDate 2026-11-12. knownRansomwareCampaignUse Unknown. forensicTriage Yes. CWE-394.","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","retracted":false}],"attributionDispute":"CISA listed CVE-2026-123158 in KEV on 9 Nov 2026 (catalog 2026.11.09). That listing is confirmed exploitation evidence from CISA. Third-party exploitation reports remain: SANS ISC (honeypot attempts beginning 5 Nov 2026), GreyNoise first successful exploitation 7 Nov 2026 00:46 UTC and Defused small-scale activity (via BleepingComputer, 9 Nov 2026), Previdian and watchTowr (6 Nov 2026). Help Net Security interview reports eight attempts from one Japan-based IP with successful root on one sensor, while Previdian's live record (fetched 6 Nov 2026) lists attempts from 3 IPs (CH, JP, SG) and says sensors do not show success. Observed on a single Previdian honeypot sensor running real Alpine Linux and OpenSSH. watchTowr Intel (6 Nov 2026, 09:28 UTC) separately reports observing exploitation; for now, it is botnets and crypto miners. SANS ISC Cowrie honeypots saw exploit attempts beginning 5 Nov 2026, earlier than Previdian's first-observed attempt on 6 Nov. Do not merge those observations. ISC figures are honeypot attempts, not production compromises. This page does not publish victim counts or campaign names from the Previdian or watchTowr reports."},"timeline":[{"id":"cisa-kev-2026-11-09","date":"2026-11-09","event":"CISA added CVE-2026-123158 (OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability) to the Known Exploited Vulnerabilities catalog (catalog 2026.11.09, released 2026-11-09T16:16:16.4275Z). dateAdded 2026-11-09, dueDate 2026-11-12. knownRansomwareCampaignUse Unknown. forensicTriage Yes. CWE-394.","source":{"title":"CISA Known Exploited Vulnerabilities Catalog","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","publisher":"CISA"},"kind":"kev","key":true,"addedDate":"2026-11-10"},{"date":"2026-11-07","event":"BleepingComputer (Bill Toulas, 9 Nov 2026) quoting GreyNoise: first successful exploitation at 00:46 UTC on 7 Nov 2026; 16 exploitation chains; one TAC Agent implant with C2 tac.vpnla[.]org. Defused reported small-scale activity, not widespread. Single reported C2 indicator, not a complete IOC set.","source":{"title":"Hackers exploit SSHole OpenSSH flaw to breach Linux systems","url":"https://www.bleepingcomputer.com/news/security/hackers-exploit-sshole-openssh-flaw-to-breach-linux-systems/","publisher":"BleepingComputer"},"kind":"reported","key":true,"addedDate":"2026-11-10"},{"date":"2026-11-09","event":"Not in CISA KEV. Catalog 2026.11.06 (released 2026-11-06T19:44:45.1797Z, 1,769 entries). Rechecked 9 Nov 2026. CVE-2026-123158 has no catalog row. Badge stays Reported exploited.","source":{"title":"CISA Known Exploited Vulnerabilities catalog","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"other","addedDate":"2026-11-09"},{"date":"2026-11-08","event":"SANS ISC diary (Johannes Ullrich): Cowrie honeypots saw the first sshole exploit attempts on 5 Nov 2026, earlier than Previdian's first-observed attempt on 6 Nov. Long-password attempts: 232 on 5 Nov, 713 on 6 Nov, 246 on 7 Nov, 51 on 8 Nov. Long passwords on 1 Nov were judged not related (buggy brute-force scripts). Cowrie keeps only the first 255 password characters, which limits attribution. Honeypot attempts, not production compromises. Badge: Reported exploited. Not a vendor or CISA listing.","source":{"title":"Scans for Sshole Vulnerability (CVE-2026-123158)","url":"https://isc.sans.edu/diary/Scans+for+Sshole+Vulnerability+CVE2026123158/33498","publisher":"SANS ISC"},"kind":"reported","key":true,"addedDate":"2026-11-09"},{"date":"2026-11-07","event":"Not in CISA KEV. Catalog 2026.11.06 (released 2026-11-06T19:44:45.1797Z, 1,769 entries). Rechecked 7 Nov 2026. CVE-2026-123158 has no catalog row.","source":{"title":"CISA Known Exploited Vulnerabilities catalog","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"other","addedDate":"2026-11-07"},{"date":"2026-11-06","event":"watchTowr Intel reports observing exploitation of SSHole (CVE-2026-123158). Post at 09:28 UTC (17:28 SGT): for now, it's botnets and crypto miners. Security.NL (6 Nov 2026) reports the same watchTowr observation. Separate from Previdian's single-sensor honeypot. Badge: Reported exploited. Not a vendor or CISA listing.","source":{"title":"Misbruik OpenSSH-lek gemeld: 'Voorlopig botnets en cryptominers'","url":"https://www.security.nl/posting/960618","publisher":"Security.NL"},"kind":"reported","key":true,"addedDate":"2026-11-07"},{"date":"2026-11-06","event":"The Hacker News recaps Previdian's honeypot report: first exploitation attempt less than nine hours after CVE publication, successful root on a honeypot running Alpine Linux and OpenSSH, eight attempts from an IP geolocated to Japan. That is the same Previdian observation. The article does not cover the watchTowr post.","source":{"title":"Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot","url":"https://thehackernews.com/2026/11/hackers-exploited-openssh-sshole-flaw.html","publisher":"The Hacker News"},"kind":"other","addedDate":"2026-11-07"},{"date":"2026-11-06","event":"Help Net Security quotes Previdian founder Ryan Dewhurst: successful root access on one honeypot running real Alpine Linux and OpenSSH. First attempt less than nine hours after CVE publication. Eight attempts from 89.116.89[.]18, described as Japan-based, all on that sensor. Badge: Reported exploited. Not a vendor or CISA listing.","source":{"title":"OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158)","url":"https://www.helpnetsecurity.com/2026/11/06/openssh-sshole-cve-2026-123158-exploitation/","publisher":"Help Net Security"},"kind":"reported","key":true,"addedDate":"2026-11-06"},{"date":"2026-11-06","event":"Previdian listed CVE-2026-123158 on its own known-exploited feed (Sensors First, 2026-11-06 09:53 UTC). Help Net Security notes CISA has not included it in KEV. That Previdian listing is not a CISA KEV row.","source":{"title":"Known Exploited Vulnerabilities Feed","url":"https://previdian.com/feed","publisher":"Previdian"},"kind":"other","addedDate":"2026-11-06"},{"date":"2026-11-06","event":"Not in CISA KEV. Catalog 2026.11.04 (released 2026-11-04T20:00:05.774Z, 1,768 entries). Rechecked 6 Nov 2026. CVE-2026-123158 has no catalog row.","source":{"title":"CISA Known Exploited Vulnerabilities catalog","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"other","addedDate":"2026-11-06"},{"date":"2026-11-05","event":"Portable OpenSSH 10.6p2 released. Workaround for sshd on musl Linux with PAM disabled. Credit: Özgün Kültekin of Wakefield.","source":{"title":"OpenSSH 10.6p2 release notes","url":"https://www.openssh.org/txt/release-10.6p2","publisher":"OpenSSH"},"kind":"patch","key":true,"addedDate":"2026-11-05"},{"date":"2026-11-05","event":"Alpine published the openssh-server password authentication bypass advisory, with fixed packages on every branch from 3.16 and the PasswordAuthentication no stopgap. The post said no CVE had been assigned at the time of writing.","source":{"title":"Security advisory: openssh-server password authentication bypass","url":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/","publisher":"Alpine Linux"},"kind":"advisory","key":true,"addedDate":"2026-11-05"},{"date":"2026-11-05","event":"Özgün Kültekin (Wakefield) published the *sshole write-up and interactive browser labs at sshhole.com.","source":{"title":"*sshole","url":"https://sshhole.com/","publisher":"Özgün Kültekin / Wakefield"},"kind":"disclosure","key":true,"addedDate":"2026-11-05"},{"date":"2026-11-05T15:46:26Z","event":"MITRE published CVE-2026-123158. CNA score CVSS 3.1 8.1. CWE-394. Description: sshd before 10.6p2 on Linux, when musl libc is used without PAM.","source":{"title":"CVE-2026-123158","url":"https://www.cve.org/CVERecord?id=CVE-2026-123158","publisher":"MITRE"},"kind":"advisory","key":true,"addedDate":"2026-11-05"},{"date":"2026-11-05T16:17:47Z","event":"NVD received CVE-2026-123158. vulnStatus Received as of 18:17 UTC. Secondary CNA metric only.","source":{"title":"NVD CVE-2026-123158","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123158","publisher":"NVD"},"kind":"other","addedDate":"2026-11-05"},{"date":"2026-11-05T17:18:17Z","event":"CISA ADP tagged sshhole.com as an exploit reference and set SSVC Exploitation to poc, Automatable no, Technical Impact total. That is a PoC assessment, not an in-the-wild mark.","source":{"title":"CVE-2026-123158 CISA ADP container","url":"https://cveawg.mitre.org/api/cve/CVE-2026-123158","publisher":"CISA ADP"},"kind":"poc","key":true,"addedDate":"2026-11-05"},{"date":"2026-11-05","event":"BleepingComputer reports the OpenSSH musl bypass and the Alpine AWS/Azure alpine user with passwordless doas. The article does not describe in-the-wild use.","source":{"title":"OpenSSH flaw lets attackers log into password-disabled Linux accounts","url":"https://www.bleepingcomputer.com/news/security/openssh-flaw-lets-attackers-log-into-password-disabled-linux-accounts/","publisher":"BleepingComputer"},"kind":"other","addedDate":"2026-11-05"},{"date":"2026-11-05","event":"IONIX publishes a defender response note. It relays the MITRE CNA CVSS 3.1 8.1 score and says NVD analysis is pending.","source":{"title":"SSHhole (CVE-2026-123158) and how IONIX is helping you respond","url":"https://www.ionix.io/blog/sshhole-cve-2026-123158-and-how-ionix-is-helping-you-respond/","publisher":"IONIX"},"kind":"other","addedDate":"2026-11-05"},{"date":"2026-11-05T18:29:00Z","event":"The Register writes there is no indication that vulnerable systems have been exploited.","source":{"title":"Get root on a musl Linux system by slamming it with an overly long password","url":"https://www.theregister.com/security/2026/11/05/get-root-on-a-musl-linux-system-by-slamming-it-with-an-overly-long-password/5307910","publisher":"The Register"},"kind":"other","key":true,"addedDate":"2026-11-05"},{"date":"2026-11-04","event":"Not in CISA KEV. Catalog 2026.11.04. Rechecked 5 Nov 2026. CVE-2026-123158 has no catalog row.","source":{"title":"CISA Known Exploited Vulnerabilities catalog","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"other","addedDate":"2026-11-05"}],"openNotes":[{"title":"CVE record and Alpine disagree on the password-length floor","detail":"Alpine gives 257 to 1024 bytes and the researcher and The Register 257 to 1,024 characters; the CVE record says 256 to 1024 characters.","sources":[{"url":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/","date":"2026-11-05","publisher":"Alpine Linux"},{"url":"https://cveawg.mitre.org/api/cve/CVE-2026-123158","date":"2026-11-05","publisher":"MITRE"},{"url":"https://sshhole.com/","date":"2026-11-05","publisher":"Özgün Kültekin / Wakefield"},{"url":"https://www.theregister.com/security/2026/11/05/get-root-on-a-musl-linux-system-by-slamming-it-with-an-overly-long-password/5307910","date":"2026-11-05","publisher":"The Register"}]},{"title":"Alpine's advisory predates the CVE assignment on the same day","detail":"Alpine wrote that no CVE identifier had been assigned at the time of writing. MITRE published CVE-2026-123158 at 15:46 UTC on 5 Nov 2026. Use the CVE on this page; do not treat Alpine's sentence as a claim that none exists.","sources":[{"url":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/","date":"2026-11-05","publisher":"Alpine Linux"},{"url":"https://cveawg.mitre.org/api/cve/CVE-2026-123158","date":"2026-11-05","publisher":"MITRE"}]},{"title":"glibc distros and UsePAM yes are OpenSSH / Alpine scope, not distro vendor statements","detail":"OpenSSH limits the workaround to musl libc with PAM disabled. Alpine says openssh-server-pam with UsePAM yes is outside its affected set. Debian, Ubuntu, RHEL, and Fedora have not published their own product statements that this page could read on 5 Nov 2026. Those rows use the out-of-scope status and are labelled Out of scope per OpenSSH / Alpine advisory (no distro statement yet), not Vendor stated not affected.","sources":[{"url":"https://www.openssh.org/txt/release-10.6p2","date":"2026-11-05","publisher":"OpenSSH"},{"url":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/","date":"2026-11-05","publisher":"Alpine Linux"}]},{"title":"OpenWrt, Buildroot, and Yocto have no vendor statement","detail":"The researcher lists Alpine, OpenWrt, Buildroot, and Yocto as musl platforms to check. No OpenWrt, Buildroot, or Yocto advisory was found on 5 Nov 2026. Those rows stay no statement yet. Possibly in scope if the preconditions match. This page does not mark them safe.","sources":[{"url":"https://sshhole.com/","date":"2026-11-05","publisher":"Özgün Kültekin / Wakefield"}]},{"title":"Help Net Security and Previdian's live CVE record disagree on attempt counts","detail":"Help Net Security (6 Nov 2026) quoting Dewhurst: eight attempts from one Japan-based address on one sensor, with successful root on that honeypot. Previdian's CVE record, fetched 6 Nov 2026, lists attempts from 3 unique attacker IPs and 3 countries (CH, JP, SG) on 1 sensor, and states that sensor observations do not show the target was vulnerable or that the attempt succeeded. Live attempt totals on that page have moved between fetches on the same day, so this page does not cite a precise Previdian attempt count. This page uses the Help Net Security interview as the reported-exploitation source and records the live Previdian IP/country set and no-success disclaimer as a same-day disagreement, not a second figure to add.","sources":[{"url":"https://www.helpnetsecurity.com/2026/11/06/openssh-sshole-cve-2026-123158-exploitation/","date":"2026-11-06","publisher":"Help Net Security"},{"url":"https://previdian.com/CVE-2026-123158","date":"2026-11-06","publisher":"Previdian"}]},{"title":"Cowrie truncates passwords, which limits ISC attribution","detail":"SANS ISC Cowrie honeypots keep only the first 255 password characters. That limits attribution of long-password attempts to this bypass. These are honeypot attempts, not production compromises. Long passwords seen on 1 Nov were judged not related to this exploit (buggy brute-force scripts).","sources":[{"url":"https://isc.sans.edu/diary/Scans+for+Sshole+Vulnerability+CVE2026123158/33498","date":"2026-11-08","publisher":"SANS ISC"}]}],"defenderActions":[{"title":"Upgrade OpenSSH and restart sshd","detail":"Install Portable OpenSSH 10.6p2 or the Alpine package for your branch, then restart sshd. Alpine: apk upgrade -U -a; rc-service sshd restart. Upgrading the package does not replace a running daemon.","priority":"now","links":[{"label":"OpenSSH 10.6p2","href":"https://www.openssh.org/txt/release-10.6p2"},{"label":"Alpine advisory","href":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/"}]},{"title":"If you cannot update: turn password logins off","detail":"Confirm key login works and keep the current session open. Set PasswordAuthentication no, and KbdInteractiveAuthentication no (IONIX). Run sshd -t, then restart sshd. Alpine documents a drop-in and a sed edit of sshd_config, including Match blocks.","priority":"now","links":[{"label":"Alpine advisory","href":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/"},{"label":"IONIX response note","href":"https://www.ionix.io/blog/sshhole-cve-2026-123158-and-how-ionix-is-helping-you-respond/"}]},{"title":"Rebuild images that install openssh-server; drop sshd where unused","detail":"IONIX: rebuild and redeploy container images that install openssh-server. Remove sshd from containers that do not need it. Alpine: containers that do not run sshd are outside this bug.","priority":"now","links":[{"label":"IONIX response note","href":"https://www.ionix.io/blog/sshhole-cve-2026-123158-and-how-ionix-is-helping-you-respond/"},{"label":"Alpine advisory","href":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/"}]},{"title":"Hunt Accepted password for accounts that should never take one","detail":"Alpine: look in /var/log/messages for sshd lines reading Accepted password for alpine, root, or any key-only user. Correlate with a shadow field of * and with the session and process activity that follows. Help Net Security (6 Nov) names 89.116.89[.]18 as reported attack-source telemetry from one Previdian honeypot. The IP alone is not proof of compromise. If you cannot rule out a login, treat the machine as compromised.","priority":"now","links":[{"label":"Alpine advisory","href":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/"},{"label":"Help Net Security (Previdian)","href":"https://www.helpnetsecurity.com/2026/11/06/openssh-sshole-cve-2026-123158-exploitation/"}]}],"detection":[{"title":"sshd Accepted password for accounts that should never take a password","detail":"Alpine: hunt sshd lines reading Accepted password for alpine, root, or any key-only user. A hit on an account whose shadow field is * is a lead. Do not invent a password probe.","logSource":"/var/log/messages (Alpine default sshd log) or your central sshd auth store","kind":"generic","url":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/","date":"2026-11-05"},{"title":"Correlate a password accept with a * shadow field","detail":"Alpine and BleepingComputer: if logs show a password login for alpine (or another key-only user) and grep '^user:' /etc/shadow shows *, treat that as a lead for this bypass.","logSource":"/etc/shadow plus sshd Accepted password lines","kind":"generic","url":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/","date":"2026-11-05"},{"title":"doas use after an unexpected password login","detail":"Alpine: review doas use on exposed machines. tiny-cloud ships passwordless doas for alpine. A doas-to-root after an Accepted password for alpine is a lead, not proof by itself.","logSource":"doas logs on the host","kind":"generic","url":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/","date":"2026-11-05"},{"title":"New users, files, and authorized_keys","detail":"Alpine: review recently created users, files, and authorized keys on exposed machines. IONIX also names unexpected users or cron jobs. A change is a lead, not proof of this bug.","logSource":"passwd/shadow, authorized_keys, and host file mtime or audit logs","kind":"generic","group":"edr","url":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/","date":"2026-11-05"},{"title":"Reported honeypot source IP 89.116.89[.]18","detail":"Help Net Security (6 Nov 2026) quoting Dewhurst: the observed source IP 89.116.89[.]18 used oversized passwords and ran recon on one Previdian honeypot. Label: reported attack-source telemetry from one honeypot (Previdian, 6 Nov). The IP alone is not proof of compromise. Help Net Security describes it as Japan-based; that is infrastructure geolocation, not actor attribution.","logSource":"sshd auth logs, firewall or netflow for SSH to in-scope hosts","kind":"generic","url":"https://www.helpnetsecurity.com/2026/11/06/openssh-sshole-cve-2026-123158-exploitation/","date":"2026-11-06"},{"title":"Abnormally long password attempts in SSH authentication logs","detail":"SANS ISC (Johannes Ullrich, 8 Nov 2026): look for abnormally long password attempts in SSH server authentication logs and correlate with accepted password logins to accounts that should not accept passwords, especially accounts whose shadow password field is *. Cowrie keeps only the first 255 password characters, which limits attribution. Long passwords seen on 1 Nov were judged not related to this exploit (buggy brute-force scripts). Do not invent a password probe.","logSource":"SSH server authentication logs (sshd/auth.log or journald)","kind":"generic","url":"https://isc.sans.edu/diary/Scans+for+Sshole+Vulnerability+CVE2026123158/33498","date":"2026-11-08"},{"title":"SANS ISC scanner IPs (low-fidelity scanner/source telemetry)","detail":"SANS ISC lists 18 initial scanner source IPs. Top five, defanged: 213.86.169[.]133 (AS8220 COLT), 152.233.50[.]185 (AS212238 Datacamp), 92.255.57[.]7 (AS55286 ServerMania), 195.178.110[.]78 (AS48090 DMZHOST), 109.94.173[.]13 (AS202660 Uzbektelekom). Label: low-fidelity scanner/source telemetry. The five are not complete coverage. See the ISC diary for the full list of 18. The IPs alone are not proof of compromise.","logSource":"sshd auth logs, firewall or netflow for SSH to in-scope hosts","kind":"generic","url":"https://isc.sans.edu/diary/Scans+for+Sshole+Vulnerability+CVE2026123158/33498","date":"2026-11-08"},{"title":"Reported TAC Agent C2 tac.vpnla[.]org (single indicator)","detail":"BleepingComputer (Bill Toulas, 9 Nov 2026) quoting GreyNoise: one attacker who gained root installed TAC Agent (Python C2) aimed at tac.vpnla[.]org. Label: single reported indicator via BleepingComputer/GreyNoise, not a complete IOC set. A DNS or proxy hit is a lead, not proof of this bug.","logSource":"Recursive DNS, proxy, or firewall logs for outbound C2 lookups","kind":"generic","url":"https://www.bleepingcomputer.com/news/security/hackers-exploit-sshole-openssh-flaw-to-breach-linux-systems/","date":"2026-11-09"},{"title":"No public Nuclei, Sigma, or vendor signature","detail":"None public as of 7 Nov 2026. Do not invent a scanner from the advisory. Use the log-source pointers above. Detection on this page will take a public scanner if one appears.","logSource":"Public rule indexes (Nuclei, Sigma) and vendor signature bulletins","kind":"generic","date":"2026-11-09","dateKind":"checked"}],"detectionRules":[],"detectionLinks":[],"retrohunt":{"summary":"GreyNoise recorded first successful exploitation at 00:46 UTC on 7 Nov 2026. Hunt DNS or proxy logs from that day for tac.vpnla[.]org, and review unexpected password logins plus unauthorized SSH keys on in-scope musl sshd hosts. This is one reported indicator via BleepingComputer quoting GreyNoise, not a complete IOC set.","lookback":{"from":"2026-11-07","basis":"first-exploitation","rationale":"BleepingComputer (9 Nov 2026) quoting GreyNoise dated the first successful exploitation to 00:46 UTC on 7 Nov 2026. Hunt the reported C2 from that day. SANS ISC first-seen attempts on 5 Nov 2026 stay on Detection; they are honeypot attempts, not this C2 window.","sources":[{"url":"https://www.bleepingcomputer.com/news/security/hackers-exploit-sshole-openssh-flaw-to-breach-linux-systems/","date":"2026-11-09","publisher":"BleepingComputer"}],"searchLine":"Search from 7 Nov 2026 (GreyNoise's first recorded successful exploitation, attributed there via BleepingComputer)."},"logSources":[{"name":"Recursive DNS resolver, proxy, or firewall logs","why":"BleepingComputer quoting GreyNoise listed tac.vpnla[.]org as the TAC Agent C2.","required":true},{"name":"SSH server authentication logs (sshd/auth.log or journald)","why":"BleepingComputer: check unexpected successful password logins for accounts whose shadow field is *.","required":false},{"name":"authorized_keys and host startup inventory","why":"BleepingComputer: check unauthorized SSH keys and TAC Agent files or startup services.","required":false}],"steps":[{"title":"List DNS or proxy lookups for tac.vpnla[.]org since 7 Nov 2026","detail":"Search resolver, proxy, or firewall logs for the C2 domain BleepingComputer quoted from GreyNoise. A lookup is a lead, not proof a host was hit.","sources":[{"url":"https://www.bleepingcomputer.com/news/security/hackers-exploit-sshole-openssh-flaw-to-breach-linux-systems/","date":"2026-11-09","publisher":"BleepingComputer"}]},{"title":"On in-scope hosts, review unexpected password logins and SSH keys","detail":"BleepingComputer: check unexpected successful password logins for shadow *, unauthorized SSH keys, and TAC Agent files or startup services. Do not send an oversized password.","sources":[{"url":"https://www.bleepingcomputer.com/news/security/hackers-exploit-sshole-openssh-flaw-to-breach-linux-systems/","date":"2026-11-09","publisher":"BleepingComputer"}]}],"queries":[],"artefacts":[{"kind":"network","value":"tac.vpnla[.]org","detail":"BleepingComputer quoting GreyNoise: TAC Agent Python C2 domain from one successful chain. A lookup is a lead, not proof.","sourceUrl":"https://www.bleepingcomputer.com/news/security/hackers-exploit-sshole-openssh-flaw-to-breach-linux-systems/","sourceDate":"2026-11-09"},{"kind":"file","value":"TAC Agent files or startup services","detail":"BleepingComputer quoting GreyNoise: one attacker installed TAC Agent after gaining root. Presence is a lead, not proof of this bug by itself.","sourceUrl":"https://www.bleepingcomputer.com/news/security/hackers-exploit-sshole-openssh-flaw-to-breach-linux-systems/","sourceDate":"2026-11-09"}],"iocs":[{"type":"domain","value":"tac.vpnla[.]org","context":"BleepingComputer (9 Nov 2026) quoting GreyNoise: one TAC Agent implant's C2. Single reported indicator, not a complete IOC set.","sourceUrl":"https://www.bleepingcomputer.com/news/security/hackers-exploit-sshole-openssh-flaw-to-breach-linux-systems/","sourceDate":"2026-11-09"}],"iocNote":"Single reported indicator via BleepingComputer quoting GreyNoise (9 Nov 2026). Not a complete IOC set.","hitMeaning":[{"level":"attempt","detail":"A DNS or proxy lookup for tac.vpnla[.]org with no password-accepted login and no TAC Agent files on the host."},{"level":"likely-compromise","detail":"An Accepted password for an account whose shadow field is * on an in-scope musl sshd, plus a lookup for tac.vpnla[.]org or unexpected authorized_keys, as BleepingComputer flags."},{"level":"compromise","detail":"TAC Agent files or startup services on a host that accepted a password for a * account, matching the GreyNoise case BleepingComputer reported. Independent validation of that implant on your estate: not verified.","label":"Compromise (your evidence)"}],"nextSteps":[{"title":"Upgrade OpenSSH and restart sshd","detail":"Portable OpenSSH 10.6p2 or the Alpine package, then restart sshd. CISA KEV due date is 12 Nov 2026 for FCEB agencies.","links":[{"label":"OpenSSH 10.6p2","href":"https://www.openssh.org/txt/release-10.6p2"},{"label":"CISA KEV catalog","href":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"}]},{"title":"Preserve DNS, sshd, and authorized_keys evidence from before restore","detail":"Keep resolver or proxy logs covering tac.vpnla[.]org and sshd Accepted password lines from 7 Nov 2026 onward.","links":[{"label":"BleepingComputer","href":"https://www.bleepingcomputer.com/news/security/hackers-exploit-sshole-openssh-flaw-to-breach-linux-systems/"}]}],"limits":["The C2 is one GreyNoise case as reported by BleepingComputer, not a complete IOC set.","A DNS lookup is a lead, not proof of compromise.","Do not send an oversized password as a test."],"sources":[{"url":"https://www.bleepingcomputer.com/news/security/hackers-exploit-sshole-openssh-flaw-to-breach-linux-systems/","date":"2026-11-09","publisher":"BleepingComputer"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-11-09","publisher":"CISA"}],"updatedAt":"2026-11-10"},"amIAffected":{"summary":"A host is in scope only when sshd is musl-linked, PAM is off, PasswordAuthentication is yes, an account that can log in has shadow field *, and another local account has a $5$ or $6$ hash. Alpine's default openssh-server package matches the first two. Inventory only. Do not send an oversized password.","checks":[{"id":"v2s-aia-sshhole-openssh-musl-cve-2026-123158-package-1","kind":"package","title":"Record the openssh package and whether sshd is musl-linked","detail":"Alpine: apk info -v openssh-server. Compare the package to the fixed build for your branch. Confirm musl with ldd on sshd. This is inventory only.","command":"apk info -v openssh-server; ldd \"$(command -v sshd || echo /usr/sbin/sshd)\" | grep -i musl; cat /etc/os-release | grep -i '^ID='","affectedMeans":"openssh-server is below the Alpine fixed package for that branch, or Portable OpenSSH is below 10.6p2, and ldd shows musl.","fixedMeans":"The installed Alpine package is at or above the fixed build, or Portable OpenSSH is 10.6p2 or later, or sshd is not musl-linked, or sshd is not installed.","notes":"Alpine stable-branch packages keep an older version string. Do not trust the SSH banner alone.","sources":[{"url":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/","date":"2026-11-05","publisher":"Alpine Linux"},{"url":"https://www.openssh.org/txt/release-10.6p2","date":"2026-11-05","publisher":"OpenSSH"}]},{"id":"v2s-aia-sshhole-openssh-musl-cve-2026-123158-config-2","kind":"config","title":"Record UsePAM, PasswordAuthentication, and shadow fields","detail":"Alpine: PAM off, PasswordAuthentication yes, a * account, and a $5$ or $6$ hash. Record sshd -T and the shadow fields. Do not submit a password.","command":"sshd -T 2>/dev/null | grep -Ei '^(usepam|passwordauthentication|kbdinteractiveauthentication|permitrootlogin)'; awk -F: '$2==\"*\"{print $1}' /etc/shadow; awk -F: '$2 ~ /^\\$[56]\\$/{print $1}' /etc/shadow","affectedMeans":"PAM is off or missing from sshd -T, PasswordAuthentication is yes, at least one printable account has *, and at least one account has a $5$ or $6$ hash.","fixedMeans":"PasswordAuthentication is no, or PAM is yes on a PAM build, or no * account can log in, or no $5$ / $6$ hash exists, or sshd is not running.","notes":"Locked ! accounts are outside Alpine's scope. root:* still needs PermitRootLogin yes for a direct password login.","sources":[{"url":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/","date":"2026-11-05","publisher":"Alpine Linux"}]},{"id":"v2s-aia-sshhole-openssh-musl-cve-2026-123158-version-3","kind":"version","title":"Record the running sshd and whether it was restarted","detail":"Alpine: upgrading the package does not replace a running sshd. Record the running daemon after the upgrade.","command":"Record the installed openssh package, the sshd process start time, and whether rc-service sshd restart (or the equivalent) has run since the upgrade.","affectedMeans":"A fixed package is installed but the running sshd still predates the restart, or the package is still below the fixed build.","fixedMeans":"sshd was restarted after the fixed package landed, or sshd is not running.","notes":"Point releases 3.21.10, 3.22.8, 3.23.8, and 3.24.4 include the fixed package.","sources":[{"url":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/","date":"2026-11-05","publisher":"Alpine Linux"}]}],"limits":["No sourced Shodan or Censys fingerprint. Do not invent a banner query.","Do not send an oversized password as a test.","An SSH banner can still show an older version on a patched Alpine package.","OpenWrt, Buildroot, and Yocto have no vendor statement.","Synology (Synology-SA-26:16), Hillstone StoneOS, and Studio Network Solutions EVO are vendor-stated not affected (6 Nov 2026).","NetApp NTAP-20261106-0011 is Interim with no product verdict yet."],"sources":[{"url":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/","date":"2026-11-05","publisher":"Alpine Linux"},{"url":"https://www.openssh.org/txt/release-10.6p2","date":"2026-11-05","publisher":"OpenSSH"},{"url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_16","date":"2026-11-06","publisher":"Synology"},{"url":"https://www.hillstonenet.com/blog/security_advisory/hillstone-products-not-affected-by-openssh-password-authentication-bypass-vulnerability/","date":"2026-11-06","publisher":"Hillstone Networks"},{"url":"https://support.studionetworksolutions.com/hc/en-us/articles/55395561889044-Technical-Advisory-CVE-2026-123158","date":"2026-11-06","publisher":"Studio Network Solutions"},{"url":"https://security.netapp.com/advisory/ntap-20261106-0011","date":"2026-11-06","publisher":"NetApp"}],"updatedAt":"2026-11-10","addedDate":"2026-11-05"},"mitigations":{"summary":"Alpine's stopgap is PasswordAuthentication no plus an sshd restart, after you confirm key login. IONIX also sets KbdInteractiveAuthentication no and asks you to run sshd -t. Neither replaces 10.6p2 or the Alpine package.","items":[{"title":"Disable password authentication and restart sshd","detail":"Alpine: set PasswordAuthentication no and restart sshd. Confirm key login first and keep the current session open. IONIX also sets KbdInteractiveAuthentication no, then validates with sshd -t.","limits":"Not a software fix. Still upgrade to 10.6p2 or the Alpine package. Alpine's drop-in is read from 3.19 onward; older releases need the sshd_config edit.","verify":"sshd -T prints passwordauthentication no. IONIX: from outside your network, the offered methods should no longer include password or keyboard-interactive. Do not submit a password as a test.","source":{"url":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/","date":"2026-11-05","publisher":"Alpine Linux"}}],"updatedAt":"2026-11-05","addedDate":"2026-11-05"},"response":{"summary":"If an in-scope host accepted a password for an account whose shadow field is *, Alpine says treat the machine as compromised if you cannot rule the login out. Upgrade and restart sshd, review doas and authorized_keys, and rotate secrets the host held. Previdian (via Help Net Security, 6 Nov 2026) reported successful root plus recon (id, uname, hostname) on one honeypot, not as a production persistence path. Reported source IP 89.116.89[.]18 is honeypot telemetry; the IP alone is not proof of compromise.","containment":[{"title":"Upgrade OpenSSH and restart sshd","detail":"Portable OpenSSH 10.6p2 or the Alpine package, then rc-service sshd restart.","sources":[{"url":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/","date":"2026-11-05","publisher":"Alpine Linux"},{"url":"https://www.openssh.org/txt/release-10.6p2","date":"2026-11-05","publisher":"OpenSSH"}]},{"title":"Turn password logins off until the upgrade lands","detail":"PasswordAuthentication no, and KbdInteractiveAuthentication no, after key login works. Validate with sshd -t.","sources":[{"url":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/","date":"2026-11-05","publisher":"Alpine Linux"},{"url":"https://www.ionix.io/blog/sshhole-cve-2026-123158-and-how-ionix-is-helping-you-respond/","date":"2026-11-05","publisher":"IONIX"}]},{"title":"Review sshd, doas, users, and authorized_keys","detail":"Hunt Accepted password for alpine, root, or key-only users. Review doas use, new users, files, and authorized_keys. Alpine: if you cannot rule out a login, treat the machine as compromised.","sources":[{"url":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/","date":"2026-11-05","publisher":"Alpine Linux"}]}],"rotate":[{"item":"Credentials and keys stored on the host","reason":"Alpine: if you cannot rule out a login, treat the machine as compromised. Rotate secrets and keys that host held. No sourced persistence path was published.","sources":[{"url":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/","date":"2026-11-05","publisher":"Alpine Linux"}]}],"observedBehaviour":[{"title":"Recon through non-interactive SSH after the password bypass (honeypot)","detail":"Dewhurst told Help Net Security the source IP ran id, uname, and hostname through non-interactive SSH sessions after the bypass. Observed on one Previdian honeypot running real Alpine Linux and OpenSSH. Not a published persistence path.","sourceUrl":"https://www.helpnetsecurity.com/2026/11/06/openssh-sshole-cve-2026-123158-exploitation/","sourceDate":"2026-11-06"},{"title":"TAC Agent implant aimed at tac.vpnla[.]org (GreyNoise, one case)","detail":"BleepingComputer (Bill Toulas, 9 Nov 2026) quoting GreyNoise: one attacker who gained root installed TAC Agent (Python C2) aimed at tac.vpnla[.]org. Single reported indicator, not a published persistence path and not a complete IOC set.","sourceUrl":"https://www.bleepingcomputer.com/news/security/hackers-exploit-sshole-openssh-flaw-to-breach-linux-systems/","sourceDate":"2026-11-09"}],"evidence":[{"title":"sshd Accepted password lines from the exposure window","detail":"Keep /var/log/messages or the central sshd auth store covering Accepted password for alpine, root, or key-only users.","sources":[{"url":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/","date":"2026-11-05","publisher":"Alpine Linux"}]},{"title":"Shadow fields and the installed openssh package","detail":"Keep a record of * and $5$ / $6$ accounts and the package version from before the upgrade.","sources":[{"url":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/","date":"2026-11-05","publisher":"Alpine Linux"}]},{"title":"doas logs and authorized_keys","detail":"Keep doas use and authorized_keys from the exposure window. No sourced persistence path was published.","generic":true,"sources":[{"url":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/","date":"2026-11-05","publisher":"Alpine Linux"}]}],"limits":["No sourced persistence paths were published.","Reported source IP 89.116.89[.]18 is honeypot telemetry (Previdian via Help Net Security, 6 Nov 2026). The IP alone is not proof of compromise.","Help Net Security and Previdian's CVE record do not describe compromised production systems or widespread attacks.","CISA ADP SSVC Exploitation poc is a lab-availability mark, not in-the-wild use.","No public Nuclei or Sigma rule as of 7 Nov 2026.","watchTowr (6 Nov 2026) reports observing exploitation (botnets and crypto miners) without publishing victim counts, IOCs, or campaign names.","BleepingComputer (9 Nov 2026) quoting GreyNoise names C2 tac.vpnla[.]org as a single reported indicator, not a complete IOC set.","Defused, via BleepingComputer (9 Nov 2026), reported small-scale activity, not widespread attacks."],"sources":[{"url":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/","date":"2026-11-05","publisher":"Alpine Linux"},{"url":"https://thehackernews.com/2026/11/hackers-exploited-openssh-sshole-flaw.html","date":"2026-11-06","publisher":"The Hacker News"},{"url":"https://www.security.nl/posting/960618","date":"2026-11-06","publisher":"Security.NL"},{"url":"https://www.helpnetsecurity.com/2026/11/06/openssh-sshole-cve-2026-123158-exploitation/","date":"2026-11-06","publisher":"Help Net Security"},{"url":"https://www.theregister.com/security/2026/11/05/get-root-on-a-musl-linux-system-by-slamming-it-with-an-overly-long-password/5307910","date":"2026-11-05","publisher":"The Register"},{"url":"https://www.bleepingcomputer.com/news/security/hackers-exploit-sshole-openssh-flaw-to-breach-linux-systems/","date":"2026-11-09","publisher":"BleepingComputer"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-11-09","publisher":"CISA"}],"updatedAt":"2026-11-10","addedDate":"2026-11-05"},"bulletins":[],"coverage":[{"title":"CISA Known Exploited Vulnerabilities Catalog","publisher":"CISA","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","date":"2026-11-09","type":"government","addedDate":"2026-11-10"},{"title":"Hackers exploit SSHole OpenSSH flaw to breach Linux systems","publisher":"BleepingComputer","url":"https://www.bleepingcomputer.com/news/security/hackers-exploit-sshole-openssh-flaw-to-breach-linux-systems/","date":"2026-11-09","type":"news","addedDate":"2026-11-10"},{"title":"Synology-SA-26:16","publisher":"Synology","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_16","date":"2026-11-06","type":"vendor","addedDate":"2026-11-10"},{"title":"Hillstone StoneOS Series Products Not Affected by OpenSSH Password Authentication Bypass Vulnerability (CVE-2026-123158)","publisher":"Hillstone Networks","url":"https://www.hillstonenet.com/blog/security_advisory/hillstone-products-not-affected-by-openssh-password-authentication-bypass-vulnerability/","date":"2026-11-06","type":"vendor","addedDate":"2026-11-10"},{"title":"Technical Advisory: CVE-2026-123158","publisher":"Studio Network Solutions","url":"https://support.studionetworksolutions.com/hc/en-us/articles/55395561889044-Technical-Advisory-CVE-2026-123158","date":"2026-11-06","type":"vendor","addedDate":"2026-11-10"},{"title":"NTAP-20261106-0011 OpenSSH Vulnerability in NetApp Products","publisher":"NetApp","url":"https://security.netapp.com/advisory/ntap-20261106-0011","date":"2026-11-06","type":"vendor","addedDate":"2026-11-10"},{"title":"Scans for Sshole Vulnerability (CVE-2026-123158)","publisher":"SANS ISC","url":"https://isc.sans.edu/diary/Scans+for+Sshole+Vulnerability+CVE2026123158/33498","date":"2026-11-08","type":"research","addedDate":"2026-11-09"},{"title":"SANS Stormcast, 9 Nov 2026 (related coverage)","publisher":"SANS ISC","url":"https://isc.sans.edu/podcastdetail/10170","date":"2026-11-09","type":"news","addedDate":"2026-11-09"},{"title":"Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot","publisher":"The Hacker News","url":"https://thehackernews.com/2026/11/hackers-exploited-openssh-sshole-flaw.html","date":"2026-11-06","type":"news","addedDate":"2026-11-07"},{"title":"Misbruik OpenSSH-lek gemeld: 'Voorlopig botnets en cryptominers'","publisher":"Security.NL","url":"https://www.security.nl/posting/960618","date":"2026-11-06","type":"news","addedDate":"2026-11-07"},{"title":"OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158)","publisher":"Help Net Security","url":"https://www.helpnetsecurity.com/2026/11/06/openssh-sshole-cve-2026-123158-exploitation/","date":"2026-11-06","type":"news","addedDate":"2026-11-06"},{"title":"CVE-2026-123158 Exploitation Attempts Observed - OpenSSH","publisher":"Previdian","url":"https://previdian.com/CVE-2026-123158","date":"2026-11-06","type":"research","addedDate":"2026-11-06"},{"title":"Known Exploited Vulnerabilities Feed (Previdian; not CISA KEV)","publisher":"Previdian","url":"https://previdian.com/feed","date":"2026-11-06","type":"research","addedDate":"2026-11-06"},{"title":"OpenSSH 10.6p2 release notes","publisher":"OpenSSH","url":"https://www.openssh.org/txt/release-10.6p2","date":"2026-11-05","type":"vendor","addedDate":"2026-11-05"},{"title":"Security advisory: openssh-server password authentication bypass","publisher":"Alpine Linux","url":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/","date":"2026-11-05","type":"vendor","addedDate":"2026-11-05"},{"title":"*sshole","publisher":"Özgün Kültekin / Wakefield","url":"https://sshhole.com/","date":"2026-11-05","type":"research","addedDate":"2026-11-05"},{"title":"CVE-2026-123158","publisher":"MITRE","url":"https://www.cve.org/CVERecord?id=CVE-2026-123158","date":"2026-11-05","type":"vendor","addedDate":"2026-11-05"},{"title":"SSHhole (CVE-2026-123158) and how IONIX is helping you respond","publisher":"IONIX","url":"https://www.ionix.io/blog/sshhole-cve-2026-123158-and-how-ionix-is-helping-you-respond/","date":"2026-11-05","type":"news","addedDate":"2026-11-05"},{"title":"Get root on a musl Linux system by slamming it with an overly long password","publisher":"The Register","url":"https://www.theregister.com/security/2026/11/05/get-root-on-a-musl-linux-system-by-slamming-it-with-an-overly-long-password/5307910","date":"2026-11-05","type":"news","addedDate":"2026-11-05"},{"title":"OpenSSH flaw lets attackers log into password-disabled Linux accounts","publisher":"BleepingComputer","url":"https://www.bleepingcomputer.com/news/security/openssh-flaw-lets-attackers-log-into-password-disabled-linux-accounts/","date":"2026-11-05","type":"news","addedDate":"2026-11-05"},{"title":"CISA KEV catalog JSON (CVE-2026-123158 listed; catalog 2026.11.09)","publisher":"CISA","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-11-09","type":"government","addedDate":"2026-11-10"}],"posts":[{"author_name":"watchTowr","handle":"watchtowrcyber","url":"https://x.com/watchtowrcyber/status/2118636513739317525","date":"2026-11-06T09:28:01Z","text":"🚨 As expected, watchTowr Intel is observing exploitation of the OpenSSH Authentication Bypass “SSHole” (CVE-2026-123158).\n\nFor now, it’s botnets and crypto miners.\nWe’re interested in what happens next."}],"research":[{"title":"Hackers exploit SSHole OpenSSH flaw to breach Linux systems","url":"https://www.bleepingcomputer.com/news/security/hackers-exploit-sshole-openssh-flaw-to-breach-linux-systems/","authors":"Bill Toulas (BleepingComputer), quoting GreyNoise and Defused","date":"2026-11-09"},{"title":"Synology-SA-26:16","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_16","authors":"Synology","date":"2026-11-06"},{"title":"Hillstone StoneOS Series Products Not Affected by OpenSSH Password Authentication Bypass Vulnerability (CVE-2026-123158)","url":"https://www.hillstonenet.com/blog/security_advisory/hillstone-products-not-affected-by-openssh-password-authentication-bypass-vulnerability/","authors":"Hillstone Networks PSIRT Team","date":"2026-11-06"},{"title":"Technical Advisory: CVE-2026-123158","url":"https://support.studionetworksolutions.com/hc/en-us/articles/55395561889044-Technical-Advisory-CVE-2026-123158","authors":"Hal Hope (Studio Network Solutions)","date":"2026-11-06"},{"title":"NTAP-20261106-0011 OpenSSH Vulnerability in NetApp Products","url":"https://security.netapp.com/advisory/ntap-20261106-0011","authors":"NetApp","date":"2026-11-06"},{"title":"*sshole","url":"https://sshhole.com/","authors":"Özgün Kültekin (Wakefield)","date":"2026-11-05"},{"title":"OpenSSH 10.6p2 release notes","url":"https://www.openssh.org/txt/release-10.6p2","authors":"Damien Miller and Darren Tucker (OpenSSH)","date":"2026-11-05"},{"title":"Security advisory: openssh-server password authentication bypass","url":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/","authors":"Timo Teräs (analysis); Natanael Copa (packages)","date":"2026-11-05"},{"title":"CVE-2026-123158 Exploitation Attempts Observed - OpenSSH","url":"https://previdian.com/CVE-2026-123158","authors":"Ryan Dewhurst (Previdian), via Help Net Security","date":"2026-11-06"},{"title":"Scans for Sshole Vulnerability (CVE-2026-123158)","url":"https://isc.sans.edu/diary/Scans+for+Sshole+Vulnerability+CVE2026123158/33498","authors":"Johannes Ullrich (SANS ISC)","date":"2026-11-08"}],"impact":{"kind":"shared-component","component":"Portable OpenSSH sshd (musl libc, PAM disabled)","matrixNote":"Alpine stable-branch packages keep their original version string (for example 10.3_p1-r2 on 3.24). An SSH banner alone cannot confirm or rule out the fix. Restart sshd after the package upgrade.","downstream":[{"product":"Portable OpenSSH","vendor":"OpenSSH","type":"cms-app","notes":"CVE-2026-123158: sshd before 10.6p2 on Linux, when musl libc is used without PAM.","status":"affected","versions":"before 10.6p2 affected; fixed in 10.6p2","vendorStatement":{"date":"5 Nov 2026","url":"https://www.openssh.org/txt/release-10.6p2","quote":"This release contains a critical security workaround that affects Linux systems that use the musl libc and PAM disabled."},"addedDate":"2026-11-05"},{"product":"Alpine Linux openssh-server","vendor":"Alpine Linux","type":"linux-distro","notes":"Point releases 3.21.10, 3.22.8, 3.23.8, and 3.24.4 ship the fix. Restart sshd after apk upgrade -U -a. Alpine: 3.21 reached end of support on 1 Nov 2026. Alpine still published fixed packages for each release back to 3.16, including 3.16 to 3.20.","status":"affected","versions":"edge 10.6_p2-r0 / 3.24 10.3_p1-r2 / 3.23 10.2_p1-r1 / 3.22 10.0_p1-r11 / 3.21 9.9_p2-r1 / 3.20 9.7_p1-r6 / 3.19 9.6_p1-r3 / 3.18 9.3_p2-r4 / 3.17 9.1_p1-r7 / 3.16 9.0_p1-r6","vendorStatement":{"date":"5 Nov 2026","url":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/","quote":"You run the Alpine openssh-server package, which is built without PAM."},"addedDate":"2026-11-05"},{"product":"Alpine Linux openssh-server-pam (UsePAM no)","vendor":"Alpine Linux","type":"linux-distro","status":"affected","vendorStatement":{"date":"5 Nov 2026","url":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/","quote":"or you run openssh-server-pam with UsePAM no."},"addedDate":"2026-11-05"},{"product":"Alpine tiny-cloud AWS / Azure images","vendor":"Alpine Linux","type":"cloud-container-hosting","notes":"Alpine: safe on first boot; exploitable once a $6$ hash exists. Images from those point releases include the fixed package. Update or disable password authentication on earlier running instances.","status":"affected","versions":"3.21.10 / 3.22.8 / 3.23.8 / 3.24.4","vendorStatement":{"date":"5 Nov 2026","url":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/","quote":"The official tiny-cloud images (the qcow2, VHD and AMI artifacts) from 3.18.11 through 3.24.3 ship an alpine user with a * password field and passwordless doas."},"addedDate":"2026-11-05"},{"product":"OpenWrt (OpenSSH sshd, if installed)","vendor":"OpenWrt","type":"network-security","notes":"Researcher lists OpenWrt as a musl platform to check. No OpenWrt vendor statement found on 5 Nov 2026. Possibly in scope if preconditions match. This page does not mark it safe.","status":"no-statement-yet","vendorStatement":{"date":"Checked 5 Nov 2026","url":"https://sshhole.com/"},"addedDate":"2026-11-05"},{"product":"Buildroot","vendor":"Buildroot","type":"linux-distro","notes":"Researcher lists Buildroot as a musl platform to check. No Buildroot vendor statement found on 5 Nov 2026. Possibly in scope if preconditions match.","status":"no-statement-yet","vendorStatement":{"date":"Checked 5 Nov 2026","url":"https://sshhole.com/"},"addedDate":"2026-11-05"},{"product":"Yocto","vendor":"Yocto Project","type":"linux-distro","notes":"Researcher lists Yocto as a musl platform to check. No Yocto vendor statement found on 5 Nov 2026. Possibly in scope if preconditions match.","status":"no-statement-yet","vendorStatement":{"date":"Checked 5 Nov 2026","url":"https://sshhole.com/"},"addedDate":"2026-11-05"},{"product":"Alpine Linux openssh-server-pam (UsePAM yes)","vendor":"Alpine Linux","type":"linux-distro","notes":"Alpine's own statement. UsePAM yes takes this package out of Alpine's affected set.","status":"vendor-stated-not-affected","vendorStatement":{"date":"5 Nov 2026","url":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/","quote":"openssh-server-pam with UsePAM yes is not affected."},"addedDate":"2026-11-05"},{"product":"Alpine cloud-init images","vendor":"Alpine Linux","type":"cloud-container-hosting","notes":"Alpine's own statement: cloud-init writes PasswordAuthentication no.","status":"vendor-stated-not-affected","vendorStatement":{"date":"5 Nov 2026","url":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/","quote":"Cloud images configured through cloud-init, which writes PasswordAuthentication no."},"addedDate":"2026-11-05"},{"product":"Containers that do not run sshd","vendor":"Alpine Linux","type":"cloud-container-hosting","notes":"Alpine's own statement: containers that do not run sshd are outside this bug.","status":"vendor-stated-not-affected","vendorStatement":{"date":"5 Nov 2026","url":"https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/","quote":"Docker and other container users that do not run sshd in the container."},"addedDate":"2026-11-05"},{"product":"Debian (glibc sshd / UsePAM yes)","vendor":"Debian","type":"linux-distro","notes":"No Debian product statement found on 5 Nov 2026. This row is OpenSSH / Alpine scope, not a Debian vendor mark.","status":"out-of-scope","vendorStatement":{"date":"5 Nov 2026","url":"https://www.openssh.org/txt/release-10.6p2","label":"Scope source: OpenSSH 10.6p2 release notes"},"addedDate":"2026-11-05"},{"product":"Ubuntu (glibc sshd / UsePAM yes)","vendor":"Canonical","type":"linux-distro","notes":"No Ubuntu product statement found on 5 Nov 2026. This row is OpenSSH / Alpine scope, not an Ubuntu vendor mark.","status":"out-of-scope","vendorStatement":{"date":"5 Nov 2026","url":"https://www.openssh.org/txt/release-10.6p2","label":"Scope source: OpenSSH 10.6p2 release notes"},"addedDate":"2026-11-05"},{"product":"Red Hat Enterprise Linux (glibc sshd / UsePAM yes)","vendor":"Red Hat","type":"linux-distro","notes":"No Red Hat product statement found on 5 Nov 2026. This row is OpenSSH / Alpine scope, not a Red Hat vendor mark.","status":"out-of-scope","vendorStatement":{"date":"5 Nov 2026","url":"https://www.openssh.org/txt/release-10.6p2","label":"Scope source: OpenSSH 10.6p2 release notes"},"addedDate":"2026-11-05"},{"product":"Fedora (glibc sshd / UsePAM yes)","vendor":"Fedora","type":"linux-distro","notes":"No Fedora product statement found on 5 Nov 2026. This row is OpenSSH / Alpine scope, not a Fedora vendor mark.","status":"out-of-scope","vendorStatement":{"date":"5 Nov 2026","url":"https://www.openssh.org/txt/release-10.6p2","label":"Scope source: OpenSSH 10.6p2 release notes"},"addedDate":"2026-11-05"},{"product":"Synology products (Synology-SA-26:16)","vendor":"Synology","type":"nas-consumer","status":"vendor-stated-not-affected","versions":"None of Synology's products are affected","vendorStatement":{"date":"6 Nov 2026","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_16","quote":"None of Synology's products are affected by CVE-2026-123158."},"addedDate":"2026-11-10"},{"product":"Hillstone StoneOS series (NGFW, WAF, NIPS/NIDS, ADC, BDS, CloudHive, LMS)","vendor":"Hillstone Networks","type":"network-security","notes":"Advisory table Release Date 6 Nov 2026; byline 5 Nov 2026. Product table: NGFW, WAF, NIPS/NIDS, ADC, BDS, CloudHive, LMS, all versions not affected.","status":"vendor-stated-not-affected","versions":"All listed versions not affected","vendorStatement":{"date":"6 Nov 2026","url":"https://www.hillstonenet.com/blog/security_advisory/hillstone-products-not-affected-by-openssh-password-authentication-bypass-vulnerability/","quote":"Upon investigation, the operating systems of Hillstone StoneOS series products are all based on glibc, and the products do not use OpenSSH's password authentication logic; therefore, they do not meet the exploitation conditions and are not affected by this vulnerability."},"addedDate":"2026-11-10"},{"product":"Studio Network Solutions EVO (EVO v7 and EVO Suite)","vendor":"Studio Network Solutions","type":"nas-consumer","status":"vendor-stated-not-affected","versions":"All SNS EVO Storage Systems; no action required","vendorStatement":{"date":"6 Nov 2026","url":"https://support.studionetworksolutions.com/hc/en-us/articles/55395561889044-Technical-Advisory-CVE-2026-123158","quote":"CVE-2026-123158 (OpenSSH Authentication Bypass): NOT AFFECTED. EVO version 7 does not include the musl C library, and SSH is disabled by default."},"addedDate":"2026-11-10"},{"product":"NetApp products (NTAP-20261106-0011)","vendor":"NetApp","type":"nas-consumer","notes":"Interim advisory with no named product Affected or Not affected list. Not a not-affected mark.","status":"under-investigation","versions":"No product verdict yet (Interim)","vendorStatement":{"date":"6 Nov 2026","url":"https://security.netapp.com/advisory/ntap-20261106-0011","quote":"Status: Interim. Last updated 11/06/2026. Version 2.0. NetApp is aware of public discussion of this vulnerability. NetApp will continue to update this advisory as additional information becomes available."},"addedDate":"2026-11-10"}]},"pocs":[{"title":"*sshole in-browser password-check demo (for defenders)","url":"https://sshhole.com/","source":"Özgün Kültekin / Wakefield","validationStatus":"unverified","validationDate":"2026-11-05","listedDate":"2026-11-05","notes":"In-browser simulation of the musl vs glibc password check by the researcher. Shows the auth bypass logic; not a working exploit against a host. Not independently verified (5 Nov 2026).","addedDate":"2026-11-05","kind":"auth-bypass-demo"}],"_feed":{"page":"https://vuln2shell.com/vulns/sshhole-openssh-musl-cve-2026-123158","json":"https://vuln2shell.com/vulns/sshhole-openssh-musl-cve-2026-123158.json","iocsCsv":"https://vuln2shell.com/vulns/sshhole-openssh-musl-cve-2026-123158/iocs.csv","stix":"https://vuln2shell.com/vulns/sshhole-openssh-musl-cve-2026-123158/stix.json","badges":{"patch":"Patched","itw":"Exploited in the wild","poc":"Public demo (auth bypass)"}}}