Linux server administrators are on alert after a security flaw was found that can let attackers bypass authentication and access certain systems without knowing the genuine password.
The serious vulnerability in OpenSSH, widely used for secure remote administration of Linux servers, was disclosed on 5 November 2026 and has caused considerable concern in the cybersecurity community.
Tracked as CVE-2026-123158 and known as SSHole, the flaw can bypass password authentication under specific conditions. An attacker who can reach a vulnerable server’s SSH service may gain access to accounts that would normally not permit a password login.
Security researcher Özgün Kültekin discovered the issue, which involves the way OpenSSH interacts with the musl system library when checking passwords.
In practice, an unusually long password can cause an incorrect interpretation of the checking result, permitting access to particular accounts without proper authentication.
Which Linux systems are at risk?
The issue primarily concerns installations using musl libc, such as Alpine Linux, which is used in cloud environments, virtual servers and container-based applications.
Several conditions must coincide for a system to be vulnerable, including the absence of PAM authentication, enabled password logins and accounts with particular password-field configurations.
Standard installations of distributions such as Ubuntu, Debian, Red Hat Enterprise Linux and Fedora, which use glibc, are not affected by this particular flaw.
The consequences can be particularly serious where an affected account has administrative privileges, since unauthorised access could lead to complete system control.
Exploitation reported after disclosure
Cybersecurity company GreyNoise reported successful exploitation attempts in monitored attack-detection systems from 7 November.
Researchers found that attackers attempted to install remote-control mechanisms and retain access.
The US Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities catalogue on 9 November, confirming that it posed an active threat.
A security update is available
OpenSSH’s developers released version 10.6p2 on 5 November, including a fix for the vulnerability.
Alpine Linux also published patched OpenSSH packages and urged administrators to install them immediately.
Restarting the SSH service after updating is essential: installing a new package alone is insufficient if the old, vulnerable daemon remains running.
Until an update can be applied, administrators can reduce exposure by disabling password authentication, provided working SSH-key access has first been confirmed.
The discovery underlines the importance of regular security updates, especially for internet-facing servers hosting websites, business applications and cloud services.
