Hackers Bypass Linux Passwords Using SSHole as CISA Confirms Active Exploitation

Hackers are already exploiting the critical SSHole vulnerability, which allows them to bypass authentication on certain Linux systems using an arbitrary password longer than 256 characters. The US Cybersecurity and Infrastructure Security Agency (CISA) has confirmed active exploitation of the flaw, which can allow attackers to gain access to system accounts and, under certain conditions, take complete control of a server.

The US Cybersecurity and Infrastructure Security Agency (CISA) has added the SSHole vulnerability, tracked as CVE-2026-123158, to its Known Exploited Vulnerabilities (KEV) catalog. This means the flaw is already being exploited in real-world attacks rather than merely demonstrated in laboratory conditions. US federal agencies are required to implement the necessary security measures by November 12, 2026.

The vulnerability has received a CVSS severity score of 8.1 out of 10 and affects systems where OpenSSH runs with the musl library without using PAM for authentication. Potentially vulnerable platforms include Alpine Linux, OpenWrt, Buildroot, Yocto, and other specialized Linux distributions. These systems are widely used in containers, routers, IoT devices, embedded equipment, and server infrastructure.

To exploit SSHole, an attacker only needs network access to the SSH service running on a vulnerable system. Under certain configurations, an arbitrary password between 257 and 1,024 characters long may successfully authenticate against accounts with locked passwords, including system accounts. If an attacker obtains root privileges, they effectively gain complete control over the device. The flaw was discovered by cybersecurity researcher Özgün Kültekin, who disclosed it in early November. The discovery quickly attracted attention from security experts because the vulnerability affects widely used software for remote Linux system administration and can be exploited without knowing the actual password.

Nearly 30 Million SSH Connections Monitored

Independent cybersecurity companies have also confirmed the active exploitation of SSHole. According to GreyNoise, its monitoring system identified six IP addresses associated with attacks and 20 instances of post-exploitation activity. In total, researchers analyzed nearly 30 million SSH connection attempts, although this does not mean that all of them were attacks exploiting SSHole.

Researchers at the SANS Internet Storm Center also detected scanning activity targeting this vulnerability and warned of an increase in exploitation attempts. This indicates that attackers are actively searching for internet-exposed devices where authentication mechanisms can be bypassed. The simplicity of the attack makes it particularly dangerous. On vulnerable systems that meet the necessary conditions, submitting a long string of characters instead of a password may be enough to gain access to an account for which password authentication should have been disabled.

The root cause of SSHole lies in the interaction between OpenSSH and the musl library, which provides several core Linux functions, including password processing. When a user enters a password longer than 256 bytes, the crypt() function in musl cannot process it and returns an asterisk (*) as an error indicator. The problem is that the same character is used in Linux system files to mark accounts with locked passwords. Under certain conditions, OpenSSH compares the result returned by the library with the stored value and mistakenly interprets the matching asterisks as successful password verification.

As a result, the system may allow access without valid credentials. However, the vulnerability does not mean that any Linux server can be compromised using a long password. Exploitation requires a specific combination of OpenSSH, musl, and authentication settings. According to the US National Vulnerability Database (NVD), the flaw involves improper handling of a function’s return code or result, which can lead to an authentication bypass under certain conditions.

OpenSSH Releases Security Update to Address the Vulnerability

The OpenSSH developers have already released a patched version of the software, although they noted that the root cause of the issue lies outside OpenSSH itself. The fix is available in version 10.6p2, while individual Linux distributions are also releasing their own security updates.

Administrators are advised to install the appropriate patches as soon as possible and restart the SSH service to ensure the updated software takes effect. If an update is not yet available, temporarily disabling password-based authentication and using SSH keys may help mitigate the risk. Administrators should also review SSH logs for suspicious successful logins, particularly those involving accounts with locked passwords.

If attackers gain root privileges, they may steal sensitive information, install malware, establish hidden access mechanisms, or use the compromised server to launch attacks against other systems. Following confirmation of active SSHole exploitation, applying security updates has become especially important for administrators managing Linux servers, containers, and networking equipment. CISA requires US federal agencies to address the vulnerability by November 12, while other organizations are strongly encouraged to install the available patches without delay.