Covered by 2 outlets — first reported by Horizon3.ai, Nov 6, 23:29 UTC
CVE-2026-123158 | OpenSSH musl Password Authentication Bypass & Remote Code Execution Vulnerability (*sshole)
MentionsOpenSSH
Summary
Attackers have begun trying to exploit "*sshole", a flaw in the OpenSSH server that lets them log in without a valid password on Linux systems using musl libc without PAM, including Alpine Linux in its default configuration. Horizon3.ai tracks it as CVE-2026-123158. SecurityWeek reports the first attempts are attributed to botnets and crypto miners, with other threat actors expected to follow.
AI summary by the SecurityTabs newsroom, checked against Horizon3.ai, SecurityWeek. Read the outlets below for the full story.
Continue reading
2 outlets, in the order they reported it.
Horizon3.aiFirst report
CVE-2026-123158 | OpenSSH musl Password Authentication Bypass & Remote Code Execution Vulnerability (*sshole)
CVE-2026-123158, known as *sshole, is an OpenSSH sshd authentication bypass on Linux systems that use musl libc without PAM, including Alpine Linux in its default configuration.
SecurityWeek
Hackers Exploiting ‘SSHole’ Authentication Bypass in OpenSSH
The initial exploitation attempts are attributed to botnets and crypto miners, but other threat actors are expected to follow suit.
Explained
The technology and terms in this story. Learn more
- TechnologyOpenSSHThe most widely used SSH implementation, shipped with Linux, macOS and Windows.
- WeaknessAuthentication bypassA flaw that lets someone in without valid credentials.
- AttackRemote code execution · RCEA flaw that lets an attacker run their own code on someone else's machine over the network.
- AttackBotnetA network of hijacked devices that an attacker controls remotely, often routers and cameras.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.