Severity: Critical | Priority: 1
A newly disclosed flaw in OpenSSH, known as SSHole and tracked as CVE-2026-123158, lets an attacker log in to an affected server without the correct credentials. The flaw affects Linux systems built on the musl C library, most notably Alpine Linux. Alpine is widely used as the base of Docker containers, cloud images and network appliances. By sending an oversized password, an attacker can log in even to accounts configured to refuse password logins. OpenSSH released the fix in version 10.6p2 on 5 November 2026. A working public exploit appeared on GitHub within about four hours, the first confirmed break-ins followed on 7 November, and CISA added the flaw to its list of actively exploited vulnerabilities on 9 November.
Researchers watching the activity recorded tens of millions of SSH connection attempts linked to the flaw, and confirmed several complete intrusions. In the most developed of these, attributed to a cluster tracked as GT10, the attackers:
TAC Agent contacts its operator over encrypted web traffic every two and a half minutes. Through it, the operator can run any command, upload and download files, and replace the agent with new code at will. Other attackers used the flaw to read password files, query cloud metadata services and steal SSH keys.
Administrators should upgrade OpenSSH to version 10.6p2 or later on every musl-based system, including Alpine hosts, containers and appliances, and rebuild container images that include an older version. Until patched, restrict SSH access to trusted networks or a VPN. On any system that ran a vulnerable version with SSH exposed, check for:
Treat any affected system as compromised: rebuild it from a clean image, and rotate its passwords, SSH keys and any cloud or application credentials it held. Administrators can switch these signatures from alert to drop to block the agent’s control channel at the perimeter.