---
title: Hackers actively exploit SSHole vulnerability in Linux systems
url: https://www.dataloco.com/en/hackers-actively-exploit-sshole-vulnerability-in-linux-systems
published: 2026-11-12T22:21:50+00:00
language: en
section: Security
source: https://xakep.ru/2026/11/10/sshole-attacks/
organizations: OpenSSH, musl, Alpine Linux, Previdian, GreyNoise
publisher: Dataloco
---

# Hackers actively exploit SSHole vulnerability in Linux systems

Security researchers report that attackers have begun exploiting SSHole, a newly discovered vulnerability assigned the identifier CVE-2026-123158, in real-world attacks. The flaw arises from an interaction between OpenSSH and the musl libc library, allowing attackers to bypass authentication on certain Linux systems.

The vulnerability affects Linux systems running musl libc where OpenSSH operates without PAM and password authentication is enabled. It permits unauthorized access to accounts where password login has been disabled through an asterisk in the /etc/shadow file. Alpine Linux is primarily affected, though other systems built with musl, including those based on Buildroot and Yocto, may also be vulnerable. OpenWrt installations running OpenSSH instead of the default Dropbear are also at risk.

OpenSSH 10.6p2, released on November 5, 2026, contains a patch for the vulnerability. Within approximately four hours of the patch's release, a proof-of-concept exploit appeared publicly, and attacks on CVE-2026-123158 commenced. Previdian researchers documented the first exploitation attempt less than nine hours after the vulnerability was disclosed, with attackers successfully bypassing authentication and obtaining root access on an Alpine Linux honeypot. By November 8, the company had recorded 20 exploitation attempts originating from 13 IP addresses across nine countries.

GreyNoise analysts reported the first successful compromise using SSHole on November 7, roughly 40 hours after the patch release. The company identified 16 successful attacks from 6 IP addresses, though researchers note this figure does not represent the full scope of exploitation. Following successful breaches, attackers gathered system and container information, requested cloud environment metadata, attempted to obtain password hashes and SSH keys belonging to the root user, and tried to add their own keys to authorized_keys files.

In one instance, attackers successfully gained root privileges and installed TAC Agent, a Python backdoor enabling shell command execution, reconnaissance, file upload and download, and self-updating capabilities. The implant failed to establish full functionality, unable to contact its command server and receive instructions. Researchers noted that TAC Agent comments, logs, and error messages contain Chinese language text, though this alone is insufficient for attribution.

WatchTowr specialists also report observing SSHole exploitation linked to botnet and cryptocurrency mining activities. Security administrators are urged to immediately install OpenSSH 10.6p2 or patched packages from their distribution, review SSH logs for suspicious successful logins to accounts with disabled password authentication, search for unfamiliar SSH keys and TAC Agent traces, and identify new services potentially installed by attackers.