Hackers are exploiting the SSHole flaw in OpenSSH to break into Alpine Linux servers

Attackers are already using SSHole (CVE-2026-123158, severity 8.1 out of 10), a flaw in OpenSSH that lets them log in to some Linux servers with any password longer than 256 characters. It works on systems built on the musl C library, Alpine Linux first of all. Threat intelligence firm GreyNoise recorded the first successful break-in on November 7 at 00:46 UTC, about 40 hours after the fix came out. After logging in, intruders looked for passwords and keys, added their own SSH keys and in one case installed a remote control agent, BleepingComputer reports.

On Linux, a in the password field of /etc/shadow means the account cannot be logged into with a password at all. Alpine uses it for root and for key-only users. The researcher Özgün Kültekin of Wakefield, who reported the bug, traced it back to a 2012 change in musl: when its password hashing function fails, it returns instead of an error. It fails on any password over 256 bytes. So a very long password "hashes" to *, which matches the locked account, and sshd lets the attacker in. With PAM enabled, sshd never compares the hashes this way, so those systems are safe.

The attack needs four things at once: sshd built against musl, PAM disabled, password authentication enabled and at least one account with in its password field. On Alpine, the first three are the defaults of the openssh-server package, and root has had since version 3.16. Alpine's official AWS and Azure images also have a default alpine user that can run commands as root without a password, so a login there gives full control.

Read the full article on vpnlab.io: https://vpnlab.io/en/sshole-openssh-flaw-exploited-alpine-linux-3290