OpenSSH sshole flaw exploited in the wild within nine hours as honeypot yields root access

Key facts

The nine-hour weaponization collapse and honeypot root breach

Automated adversary exploitation of a critical OpenSSH authentication bypass vulnerability affecting Alpine Linux and musl-based systems has commenced across the public Internet, arriving less than 9.0 hours (<540.0 minutes) (derived) after the vulnerability was publicly disclosed. Threat intelligence firm Previdian confirmed that adversary probes successfully compromised an authentic Alpine Linux honeypot to achieve administrative root access, leveraging oversized password payloads to bypass authentication barriers on locked accounts.

Tracked as CVE-2026-123158 and nicknamed sshole by security researcher Ozgun Kultekin, the vulnerability was addressed in OpenSSH version 10.6p2 on 5 November 2026. The vulnerability stems from an architectural collision between OpenSSH timing mitigation logic and the musl standard C library's password hashing routine. When an attacker submits an oversized password exceeding 256 bytes (derived), musl returns an asterisk character that perfectly matches the shadow password field reserved for locked accounts, allowing immediate login on systems configured without Pluggable Authentication Modules (PAM).

Zoom

Operational telemetry and technical parameters of observed OpenSSH in-the-wild attacks

Telemetry Parameter	Recorded Observation	Measurement Standard	Operational Significance
Vulnerability Identifier	CVE-2026-123158 (sshole)	National Vulnerability Database	Authentication bypass on musl OpenSSH
Time to First Exploit	<9.0 Hours (<540.0 Mins)	Elapsed time from CVE release (derived)	Extreme weaponization compression window
Attacker Source Address	89.116.89[.]18	Previdian sensor honeypot capture	Host infrastructure in Japan executing mass scans
Sensor Incursion Count	8 Recorded Attempts	Single honeypot sensor telemetry (derived)	Automated non-interactive SSH probing
Payload Threshold	>=257 Character Bytes	1 byte overflow past 256-byte limit (derived)	Triggers musl crypt() error return asterisk
Post-Breach Commands	id, uname, hostname	Non-interactive terminal execution	Automated system profiling and privilege validation

Previdian founder Ryan Dewhurst revealed that the firm's global telemetry sensors recorded their first live exploitation attempt within nine hours of the official CVE advisory. The initial campaign targeted standard OpenSSH port 22 listeners using non-interactive SSH sessions designed to bypass terminal allocation and execute automated discovery commands.

Anatomy of the 257-byte crypt collision and shadow match

The vulnerability is rooted in an unfortunate interaction between security mechanisms implemented in OpenSSH and the musl standard C library over the past decade. In 2016, OpenSSH introduced changes to sshd to remediate a user enumeration timing side-channel (CVE-2016-6210). When a client attempts to authenticate against an account that has no valid password hash (such as accounts marked with an asterisk in /etc/shadow), OpenSSH avoids terminating the connection prematurely. Instead, sshd borrows the salt of another valid local account and executes a real crypt() computation against the user-supplied string, ensuring that login response latency remains identical regardless of whether an account exists.

However, since 2012, musl libc's implementation of the crypt() function has enforced a strict 256-byte buffer limit on SHA-256 and SHA-512 password inputs. If an incoming password exceeds 256 bytes, musl aborts the cryptographic computation and returns an error string consisting of a single asterisk (*).

Zoom

This error return created a fatal collision: an adversary submits a password of 257 bytes or longer to an account marked with an asterisk in /etc/shadow (such as root or default deployment users). OpenSSH hashes the oversized password using musl's crypt(). musl encounters the buffer overflow condition and returns an asterisk to indicate an error. OpenSSH compares the computed result against the hash field in /etc/shadow. The strings match identically, and OpenSSH grants full administrative login.

Systems utilizing the GNU C Library (glibc) remain unaffected because glibc does not return an asterisk upon encountering overlong passwords. Similarly, installations utilizing Pluggable Authentication Modules (PAM) are immune because PAM incorporates independent credential validation layers.

Cloud image exposure and the active daemon restart trap

The operational blast radius of CVE-2026-123158 is particularly acute in lightweight cloud infrastructure, container base images, and embedded network appliances. Alpine Linux is widely deployed across enterprise cloud estates due to its minimal base image footprint, serving as the default foundation for thousands of microservices and Docker containers.

The vulnerability affects 10 distinct Alpine distribution branches (derived), spanning versions 3.16 through 3.24 as well as edge. Crucially, official tiny-cloud images provided by Alpine for Amazon Web Services (AWS) and Microsoft Azure (versions 3.18.11 through 3.24.3) ship with a default alpine user that has password authentication enabled but lacks a set password, carrying an asterisk in /etc/shadow. Because this default cloud account possesses passwordless doas administrative privileges, an attacker exploiting the vulnerability on an exposed cloud instance obtains immediate, unrestricted root execution.

Furthermore, enterprise security teams face a critical operational trap during remediation: package installation does not terminate active listening daemons. When administrators update the openssh-server package via the package manager (apk upgrade openssh), the operating system replaces the binary on disk but leaves the existing sshd process active in memory. Unless administrators explicitly execute rc-service sshd restart, the unpatched daemon continues listening on port 22 and remains completely exploitable.

Remediation blueprint, hunting queries, and daemon verification

With active in-the-wild exploitation confirmed and proof-of-concept scripts proliferating across developer forums, organizations operating Linux infrastructure must execute immediate verification and containment.

Zoom

Emergency operational remediation and threat hunting directives

Operational Task	Shell Execution Directive	Target System Environment	Defensive Objective
1. Update Package	apk update && apk add openssh-server	Alpine Linux Package Manager	Install patched OpenSSH 10.6p2 binary on disk
2. Restart Daemon	rc-service sshd restart	OpenRC Service Supervisor	Terminate vulnerable in-memory sshd parent process
3. Disable Passwords	echo PasswordAuthentication no >> /etc/ssh/sshd_config	sshd Server Configuration	Eliminate password authentication attack surface completely
4. Reload Config	kill -HUP $(cat /var/run/sshd.pid)	Active Process Signal	Apply configuration hardening to active sessions
5. Threat Hunting	grep Accepted password for /var/log/messages	System Authentication Logs	Identify past unauthorized logins on locked accounts
6. Perimeter Block	iptables -A INPUT -s 89.116.89.18 -j DROP	Network Boundary Firewall	Block confirmed adversary scanner infrastructure

OpenSSH maintainer Damien Miller urged administrators on musl systems to apply PasswordAuthentication no immediately without waiting for package update cycles. Security operations teams should inspect /var/log/messages and central auth logs for anomalous successful password logins on accounts that lack passwords, treating any matched machine as compromised.