# SZB-44f5e7b0cb: Attackers exploit 'SSHole' authentication bypass in OpenSSH

SecurityWeek reports that exploitation attempts against an OpenSSH authentication bypass dubbed 'SSHole' have begun. The initial attempts are attributed to botnets and crypto miners, and other threat actors are expected to follow.

- Type: Early warning
- Kind: Vulnerability
- Vendor: OpenSSH
- Product: OpenSSH
- Status: Confirmed
- Sources: 9 distinct
- First seen: 2026-11-07 04:44 UTC
- Confirmed: 2026-11-09 16:06 UTC

Written by a model from the sources below. Verify against them.

## What to do

- Update OpenSSH to a patched release as soon as one is available from your distribution or vendor
- Restrict SSH access to trusted networks or VPNs until patched
- Review authentication logs for unexpected successful logins
- Identify OpenSSH versions in use and apply the vendor patch as soon as it is available
- Rotate credentials on any host that may have been exposed

## Timeline

- 2026-11-06 17:54 UTC: Made public by Mastodon
- 2026-11-07 04:44 UTC: First seen by cve.now
- 2026-11-09 16:06 UTC: Record last updated
- 2026-11-09 16:06 UTC: Confirmed as CVE-2026-123158

## Evidence (9 sources)

- 2026-11-06 · Social · [Mastodon](https://mastodon.social/@Analyst207/117570777189225293): “Within nine hours of being made public, the SSHole flaw (CVE-2026-123158) was exploited by hackers, highlighting the alarming speed at which cyber threats can spread.”
- 2026-11-06 · Social · [Mastodon](https://infosec.exchange/@security_crawler_carl/117570843378788905): “Patch OpenSSH immediately — there is no negotiating with CVE-2026-123158.”
- 2026-11-07 · Social · [oss-security](https://seclists.org/oss-sec/2026/q4/571): “Re: "sshole": password authentication bypass: OpenSSH + musl libc” (+1 more: [oss-security](https://seclists.org/oss-sec/2026/q4/573))
- 2026-11-08 · Social · [Mastodon](https://infosec.exchange/@threatnoir/117581198988434312): “OpenSSH vulnerability CVE-2026-123158 (SSHole) is under active exploitation within hours of disclosure.”
- 2026-11-08 · Social · [Mastodon](https://mastodon.social/@secpoint/117583177121077654): “An attacker reaching SSH on certain musl-based Linux systems, including Alpine Linux, may log in to accounts that should not accept passwords.”
- 2026-11-09 · Social · [r/cybersecurity](https://www.reddit.com/r/cybersecurity/comments/1xrfyu0/sshole_a_long_password_could_bypass_ssh/): “Under specific conditions, an attacker with network access to the SSH service can authenticate to an account that has no password configured by sending an unusually long password.”
- 2026-11-09 · Social · [Mastodon](https://infosec.exchange/@DailyCyberSecurity/117585812704065359): “The OpenSSH SSHole vulnerability is being actively exploited against Alpine Linux honeypots, prompting urgent upgrades to OpenSSH 10.6p2.”
- 2026-11-09 · Press · [SecurityWeek](https://www.securityweek.com/hackers-exploiting-sshole-authentication-bypass-in-openssh/): “The initial exploitation attempts are attributed to botnets and crypto miners, but other threat actors are expected to follow suit.”
- 2026-11-09 · Press · [BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-exploit-sshole-openssh-flaw-to-breach-linux-systems/): “Hackers are actively exploiting the "SSHole" vulnerability (CVE-2026-123158) in OpenSSH to execute commands, steal credentials, and establish persistent access.” (+1 more: [BleepingComputer on Bluesky](https://bsky.app/profile/bleepingcomputer.com/post/3mzvckfnpn52h))

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-44f5e7b0cb&body=https%3A%2F%2Fcve.now%2FSZB-44f5e7b0cb%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about SZB-44f5e7b0cb

### Has OpenSSH confirmed it?

Yes. Confirmed as CVE-2026-123158.

Source: https://mastodon.social/@Analyst207/117570777189225293, https://infosec.exchange/@security_crawler_carl/117570843378788905, https://seclists.org/oss-sec/2026/q4/571, https://infosec.exchange/@threatnoir/117581198988434312, https://mastodon.social/@secpoint/117583177121077654, https://www.reddit.com/r/cybersecurity/comments/1xrfyu0/sshole_a_long_password_could_bypass_ssh/, https://infosec.exchange/@DailyCyberSecurity/117585812704065359, https://www.securityweek.com/hackers-exploiting-sshole-authentication-bypass-in-openssh/, https://www.bleepingcomputer.com/news/security/hackers-exploit-sshole-openssh-flaw-to-breach-linux-systems/

### What should OpenSSH users do?

Update OpenSSH to a patched release as soon as one is available from your distribution or vendor. Restrict SSH access to trusted networks or VPNs until patched. Review authentication logs for unexpected successful logins. Identify OpenSSH versions in use and apply the vendor patch as soon as it is available. Review authentication and system logs for unexpected logins or new persistence mechanisms. Rotate credentials on any host that may have been exposed.

### Does it have a CVE?

Yes. It is tracked as CVE-2026-123158.

Source: https://cve.now/CVE-2026-123158

## Tracked as

- [CVE-2026-123158](https://cve.now/CVE-2026-123158.md)

## Related

- Browse: [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/SZB-44f5e7b0cb
Site guide for agents: https://cve.now/llms.txt