SSHole: OpenSSH vulnerability is often exploited for server takeovers
The critical vulnerability in OpenSSH that we recently reported on is now being actively exploited to attack Linux systems. Attackers can easily log in here without a password.
Quick successes
Attackers can use the SSHole vulnerability (CVE-2026-123158) to bypass authentication mechanisms, obtain credentials, and gain persistent access to compromised servers. Several security companies have now confirmed successful attacks and strongly advise administrators to install the available update. The first attack attempts were already registered when the bug became known on November 5th. A proof-of-concept exploit was also released that day. Just one day later, security researchers were able to observe successful attacks, like the magazine BleepingComputer reported. So only those who directly installed the patch provided were protected.
The issue affects certain OpenSSH installations on Linux systems that are based on the Musl library. This particularly includes the slim Alpine Linux distribution, which is often used in cloud environments and containers. Under certain conditions, SSHole makes it possible to log in to an account from outside via an SSH connection without asking for a password. The security company GreyNoise registered what was probably the first successful attack.
In total, the researchers documented 16 successful attack chains that originated from six different IP addresses. The attackers examined systems and containers, queried cloud metadata, tried to read password hashes and SSH keys, and manipulated authorized SSH keys for permanent access.
Even root once
In one case, an attacker even gained root privileges and installed the Python-based malicious code TAC Agent. This enables, among other things, the execution of shell commands and file transfers. However, a connection to the control server was not established. Other security companies also confirm attempts at exploitation.
WatchTower observed attacks related to botnets and cryptomining as early as November 6th. Linux administrators should therefore immediately update OpenSSH or disable password authentication for SSH on affected systems. We also recommend checking for unusual successful logins, unauthorized SSH keys and suspicious autostart services.
Research Snipers is currently covering all technology news including Google, Apple, Android, Xiaomi, Huawei, Samsung News, and More. Research Snipers has decade of experience in breaking technology news, covering latest trends in tech news, and recent developments. Can be reached at author1@researchsnipers.com
