OpenSSH CVE-2026-123158: root on a honeypot in nine hours

Previdian watched CVE-2026-123158 used for a root login on its own Alpine honeypot less than nine hours after the identifier was published. The flaw is the OpenSSH bug nicknamed SSHole, which this desk reported on November 5, when the release that closes it, OpenSSH 10.6p2, became public. The new fact is the speed. A login that should have been impossible is already in use.

Founder Ryan Dewhurst told The Hacker News that the first attempt arrived less than nine hours after publication, and that the firm confirmed root on a honeypot running Alpine Linux and OpenSSH. The telemetry he described was eight attempts from one address geolocated to Japan, 89.116.89[.]18. Those sessions were non-interactive and were used to look at the host. The confirmed root login is the honeypot. Previdian has published an attempt count, and a honeypot result, for that address.

Who is still in the window

The exposed set is OpenSSH before 10.6p2 on Linux that uses the musl C library, with PAM off and password authentication left on. Alpine’s default openssh-server package is built that way. OpenWrt, Buildroot, Yocto, and container images built on Alpine belong in the same pass. The login reaches accounts configured so no password should work, including key-only accounts. Accounts that hold a real password hash still depend on that password.

glibc distributions sit outside this bug. Dropbear, non-Linux hosts, and any sshd that checks passwords through PAM sit outside it as well. The published score is 8.1.

On Alpine’s official images for Amazon Web Services and Azure, the default account named alpine can raise itself to root through passwordless doas once a session exists. A password acceptance on that account is a root path. Previdian’s honeypot reaching root is that shape of host, observed in use.

Install the package, then restart the daemon

Move OpenSSH to 10.6p2, or to the patched package your distribution ships for this bug, and then restart sshd. The package install leaves the running daemon on the old binary until that restart. Read the version the live service reports after it comes back. A banner that still shows an older build is still in the bug.

If the package cannot land today, turn password authentication off and restart the service, after key-based login is confirmed to work. OpenSSH developer Damien Miller has told operators of musl hosts without PAM to do that immediately. Cover appliances and images with the servers. A router built with OpenWrt, and a container that has been up since last month, are both SSH servers.

What an accepted password means now

After the restart, read the authentication log for a successful password login on an account that is supposed to refuse one. Alpine names the alpine account, root, and any key-only user. On the cloud images, a password acceptance for alpine is the line that matters. Review privilege use in the same window, accounts you did not create, and authorized keys you did not issue.

If you cannot account for the session, treat the host as compromised. Rotate the credentials it could reach, replace any trust that account held, and rebuild the image if the login has no innocent explanation.

The fix has been public since November 5. The first observed attempt followed overnight. A musl SSH daemon that still accepts passwords is late.

This briefing relies on public reporting by The Hacker News and on Previdian’s statement. It does not include exploit procedures.