SSHole, the OpenSSH Alpine bypass, is now under active attack
GreyNoise has confirmed 16 successful exploitations of CVE-2026-123158 across its honeypots, starting under 40 hours after the patch shipped. One attacker tried installing a Python C2 agent after gaining root.
The OpenSSH password bypass on musl-based Linux, patched on 5 November as 10.6p2, now has a name and a track record: CVE-2026-123158, nicknamed SSHole, is being exploited in the wild. GreyNoise’s live tracker reports 16 confirmed successful exploitations across its honeypot network, with the first landing on 7 November at 00:46 UTC, under 40 hours after the fix was published.
The bug itself hasn’t changed: musl’s crypt() function returns a bare * for passwords between 257 and 1024 bytes, which matches the * stored for accounts with no password set, so an attacker who sends a long enough password logs straight in as root or any key-only user. It only hits musl distributions with PAM disabled, chiefly Alpine, OpenWrt, Yocto and Buildroot. GreyNoise attributes the activity to three separate clusters; one, tracked as GT10, got root on a honeypot and tried installing TAC Agent, a self-contained Python command-and-control tool, though GreyNoise says it never reached its control server.
Why it matters: if you run Alpine containers or OpenWrt/Yocto builds with password auth on a no-password account, updating the package isn’t enough. You have to restart sshd, and this confirms attackers are already scanning for exactly that gap.
The caveat: GreyNoise’s count only covers its own honeypots, so real-world exploitation is almost certainly higher than 16.