---
title: SSHole (CVE-2026-123158) is being exploited: watchTowr sees botnets and crypto miners hitting the OpenSSH musl password bypass | ctxsec
url: https://ctxsec.com/items/openssh-sshole-cve-2026-123158-exploited-watchtowr
description: "Hours after Alpine and OpenSSH published the long-password authentication bypass for sshd on musl/PAM-disabled Linux, watchTowr Intel says it is observing active exploitation. For now the traffic looks like botnets and crypto miners. The bug (CVE-2026-123158, CVSS 8.1) lets an attacker who can reach sshd log into accounts whose shadow password field is '*' by sending any 257\u20131024 byte password, as long as the host also has at least one $5$/$6$ hash and password authentication is on. OpenSSH 10.6p2 carries the workaround; Alpine packages need an update and an sshd restart."
status: "confirmed (watchTowr Intel observing exploitation Nov 6; Alpine advisory + OpenSSH 10.6p2 Nov 5; CVE-2026-123158 / CVSS 8.1 per SecurityWeek); not in CISA KEV as of catalog 2026.11.04"
published: 2026-11-06
---

> Hours after Alpine and OpenSSH published the long-password authentication bypass for sshd on musl/PAM-disabled Linux, watchTowr Intel says it is observing active exploitation. For now the traffic looks like botnets and crypto miners. The bug (CVE-2026-123158, CVSS 8.1) lets an attacker who can reach sshd log into accounts whose shadow password field is '*' by sending any 257–1024 byte password, as long as the host also has at least one $5$/$6$ hash and password authentication is on. OpenSSH 10.6p2 carries the workaround; Alpine packages need an update and an sshd restart.

[← Cybersecurity News](/news) · [markdown](/items/openssh-sshole-cve-2026-123158-exploited-watchtowr.md)

confirmed (watchTowr Intel observing exploitation Nov 6; Alpine advisory + OpenSSH 10.6p2 Nov 5; CVE-2026-123158 / CVSS 8.1 per SecurityWeek); not in CISA KEV as of catalog 2026.11.04

2026-11-06

### SSHole (CVE-2026-123158) is being exploited: watchTowr sees botnets and crypto miners hitting the OpenSSH musl password bypass

- **Who is hit:** Alpine (3.16–3.24 and edge, and openssh-server without PAM or with UsePAM no), plus other musl/PAM-disabled builds such as OpenWrt, Buildroot and Yocto. openssh-server-pam with UsePAM yes is not affected.
- **Why it escalated overnight:** Alpine's Nov 5 advisory said no exploitation had been seen yet. watchTowr's Nov 6 post flips that — scanning and opportunistic abuse are already running.
- **Immediate actions:** upgrade openssh and **restart sshd** (package upgrade alone does not replace the running daemon), or set `PasswordAuthentication no` and restart. Prefer key-only auth going forward.
- **KEV:** not listed in CISA's catalog as of 2026.11.04 (latest adds were Apple CVE-2024-27834 and WordPress CVE-2026-119977).

Sources: [watchTowr on X: observing SSHole CVE-2026-123158 exploitation (Nov 6)](https://x.com/watchtowrcyber/status/2118636513739317525) · [Alpine Linux: openssh-server password authentication bypass (Nov 5)](https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/) · [OpenSSH 10.6p2 release notes](https://www.openssh.com/txt/release-10.6p2) · [SecurityWeek: OpenSSH rushes patches for SSHole (CVE-2026-123158)](https://www.securityweek.com/openssh-rushes-patches-for-sshole-authentication-bypass/)