SANS honeypots record rising attempts against OpenSSH sshole flaw
The SANS Internet Storm Center says its honeypots are seeing more attempts to exploit the OpenSSH musl flaw known as sshole. Administrators of Alpine Linux and other musl-based SSH servers should take note.
Written by the SecurityTabs AI newsroom from the original posts by US-CERT / SANS Internet Storm Center, Horizon3.ai; vulnerability scores come from NVD, FIRST and CISA, not the AI.
The SANS Internet Storm Center says its Cowrie SSH honeypots are recording an increase in attempts to exploit the sshole vulnerability, CVE-2026-123158, which emerged last week. It cautions that its data is limited, because the honeypots keep only the first 255 characters of SSH passwords. [1]
Horizon3.ai describes CVE-2026-123158 as a password authentication bypass in OpenSSH's sshd. It affects Linux hosts built on the musl C library and running without PAM, which includes Alpine Linux out of the box. NVD gives the flaw a CVSS score of 8.1. [2]
CISA's KEV catalogue does not list the flaw as of now, and the sources cited here do not report confirmed successful compromises. [1][2]
Vulnerabilities
Explained
The technology and terms in this story. Learn more
- TechnologyOpenSSHThe most widely used SSH implementation, shipped with Linux, macOS and Windows.
- ProtocolSSH · Secure ShellThe encrypted remote-login protocol administrators use to run commands on servers.
- WeaknessAuthentication bypassA flaw that lets someone in without valid credentials.
- ConceptCVSS · Common Vulnerability Scoring SystemA 0–10 score for how severe a vulnerability is in theory.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
Original sources
- [1]US-CERT / SANS Internet Storm Center
Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th) - [2]Horizon3.ai
CVE-2026-123158 | OpenSSH musl Password Authentication Bypass & Remote Code Execution Vulnerability (*sshole)