OpenSSH rushes patch for SSHole authentication bypass, exploited within hours

· Cybersecurity

OpenSSH released urgent patches for an authentication bypass tracked as CVE-2026-123158, codenamed SSHole, affecting Linux systems that run OpenSSH, according to SecurityWeek and The Hacker News. On Linux distributions using musl libc without PAM, some accounts accept any password between 257 and 1024 characters, effectively allowing sign-in to accounts that have no password set. The vulnerability carries a CVSS score of 8.1. Threat actors began attempting exploitation within hours of disclosure, with one researcher reporting attackers gained root on a honeypot. The flaw matters because OpenSSH underpins remote administration across servers and cloud infrastructure, and its Alpine Linux-style deployments are common in containers. Patching is the direct remedy; the speed of exploitation leaves little room for delay.

Why it matters：OpenSSH is the default remote-administration layer for servers and containers, so a trivially exploitable bypass puts a wide swath of cloud and on-premises infrastructure at risk of rapid root compromise.

Key points

  • CVE-2026-123158 carries a CVSS score of 8.1.
  • Affected accounts accept any password of 257 to 1024 characters.
  • Exploitation attempts began within hours of disclosure, including a honeypot root compromise.

Sources (original reporting)

More stories from this day