Source: SANS Internet Storm Center
The OpenSSH password authentication bypass nicknamed SSHole, tracked as CVE-2026-123158, has moved from disclosure to active scanning. Johannes Ullrich of the SANS Internet Storm Center reported on 8 November 2026 that the centre’s Cowrie SSH honeypots recorded a steep climb in attempts to exploit the flaw, from 23 long-password attempts on 1 November to 713 on 6 November. The vulnerability was disclosed on 5 November 2026 and carries a CVSS v3.1 score of 8.1.
Who is affected
The bypass does not hit every SSH server. It affects Linux systems running OpenSSH built against musl libc with PAM disabled, which lets a remote attacker authenticate to an eligible account without knowing its password. Alpine Linux is the most prominent affected platform, and its minimal footprint makes it a default choice for containers and CI runners across many European engineering teams. Standard glibc distributions such as Debian and Ubuntu with PAM enabled, along with Dropbear and OpenBSD, are outside the scope of the bypass. Custom builds should be assessed by their actual authentication stack.
What the honeypot data shows
The exploitation pattern is distinctive. The ISC honeypots collect only the first 255 characters of SSH passwords, and the spike consists of unusually long password strings, exactly the shape this exploit produces. Ullrich also observed a curious side effect: some buggy brute force scripts entered shell commands intended for a post-login shell in the password field, and because of the bypass those commands actually executed. One such string downloaded and ran a bot binary from an external host, which means unpatched systems are not just reachable, they are being turned into implant delivery targets.
What to do now
The priority is to install a fixed OpenSSH package and restart sshd on every host that matches the affected configuration. If patching must wait, disable password authentication and rely on key-based access. Beyond this single CVE, the incident is a useful prompt for an SSH estate review: inventory where sshd actually runs, including inside containers, confirm libc and PAM configuration, enforce key-only authentication and restrict which hosts expose SSH to the internet at all.
If your infrastructure includes Alpine-based containers or minimal SSH deployments and you want help auditing exposure, building a patch pipeline or hardening remote access, contact Excello Digital for a security review by engineers who work with these stacks daily.