OpenSSH flaw allows login with blank passwords on specific Linux setups

Threat actors have begun actively exploiting a critical vulnerability in OpenSSH that permits authentication to user accounts configured without passwords. The flaw, identified as CVE-2026-123158 and nicknamed SSHole, specifically targets Linux distributions using the musl C library with Pluggable Authentication Modules disabled. As of November 9, 2026, security researchers recorded twenty exploitation attempts originating from thirteen unique IP addresses across multiple countries.

What happened

The vulnerability affects systems running OpenSSH on the musl C library, most notably the default configuration found in Alpine Linux. When Pluggable Authentication Modules (PAM) are disabled, the authentication logic fails to properly enforce password requirements for empty fields. This oversight allows an attacker to sign in to any account that does not have a password set, effectively bypassing standard credential checks.

While the issue requires a specific system configuration, it poses a significant risk to containerized environments and lightweight server deployments that frequently rely on Alpine Linux. The Common Vulnerability Scoring System (CVSS) rates this flaw at 8.1, indicating a high severity level. Exploitation does not require complex tools; attackers simply attempt to log in with blank credentials, leveraging the misconfiguration to gain unauthorized access.

Beyond this specific OpenSSH issue, the week saw several other notable security incidents. A trojanized version of the Control Web Panel server daemon, cwpsrv, was distributed to deliver a stealthy backdoor called CWPdoor. Additionally, a zero-day vulnerability in Zyxel GS1900 network switches was exploited to compromise nearly one thousand devices worldwide, allowing attackers to steal credentials and deploy rootkits.

Key details

• Vulnerability ID: CVE-2026-123158, also known as SSHole.
• Affected Systems: Linux systems using OpenSSH with the musl C library and PAM disabled, including default Alpine Linux installations.
• Impact: Allows remote sign-in to user accounts that have no password set.
• Severity: CVSS score of 8.1.
• Activity Level: Twenty exploitation attempts detected from thirteen unique IP addresses as of November 9, 2026.
• Source Locations: Attempts originated from Denmark, Iran, Japan, the Netherlands, Norway, Singapore, Sweden, Switzerland, and the U.S.

Background

OpenSSH is the standard secure shell protocol implementation used by most Linux and Unix-like operating systems for remote administration. It relies on underlying system libraries for cryptographic operations and authentication handling. The musl C library is a lightweight, fast, and standards-compliant C standard library often chosen for embedded systems and containers due to its small footprint. Alpine Linux, a popular distribution for Docker containers, uses musl by default instead of the more common glibc.

Pluggable Authentication Modules (PAM) provide a flexible mechanism for authenticating users. When PAM is enabled, it handles complex authentication policies, including password strength and expiration. However, some minimal configurations disable PAM to reduce dependencies or improve performance. In these cases, OpenSSH handles authentication directly. The SSHole vulnerability arises from a logic error in this direct handling path when interacting with musl, where empty password strings are not correctly rejected for accounts that should require credentials.

Why it matters

For teams managing self-hosted infrastructure, this vulnerability highlights the risks associated with minimal or default configurations. Many developers choose Alpine Linux for its small size and security reputation, assuming that fewer components mean a smaller attack surface. However, this incident demonstrates that default settings can sometimes introduce unexpected weaknesses. If your servers use Alpine or other musl-based distributions and have user accounts without passwords, they are immediately vulnerable to remote takeover.

The active exploitation of this flaw means that internet-facing servers are already being scanned and targeted. Unlike theoretical vulnerabilities, SSHole is being used in the wild right now. For DevOps engineers and sysadmins, this requires immediate verification of server configurations. It is not enough to simply patch the software; you must also ensure that authentication policies are correctly enforced, particularly in environments where PAM has been deliberately disabled for simplicity or performance reasons.

Furthermore, this event serves as a reminder that supply chain and configuration hygiene are critical. The same week saw attacks on update mechanisms for web security suites and network devices. Relying on default settings without understanding their security implications can leave gaps that attackers exploit quickly. Teams must balance the convenience of lightweight distributions with the need for robust authentication controls.

What you can do

• Audit all Linux servers running OpenSSH to identify those using the musl C library, such as Alpine Linux.
• Check if Pluggable Authentication Modules (PAM) are disabled in your OpenSSH configuration files.
• Ensure no user accounts on affected systems are configured with empty or blank passwords.
• Apply the latest security patches for OpenSSH provided by your distribution vendor immediately.
• Monitor access logs for failed or successful login attempts from unknown IP addresses, especially those listed in recent threat reports.
• Consider enabling PAM or switching to a glibc-based distribution if your security policy requires strict password enforcement and you cannot guarantee all accounts have strong credentials.