What happened
CVE‑2026‑123158, nicknamed “sshole,” bypasses authentication on musl‑based systems by exploiting how OpenSSH handles password hashes that contain a “*”. An attacker can send an oversized password string, causing OpenSSH to accept the login and grant root access. The vulnerability was patched in OpenSSH 10.6p2 on November 5 2026, but threat‑intel firm Previdian recorded successful exploitation on a honeypot less than nine hours after the advisory was published. Eight attempts from a single IP were observed, with at least one achieving full root compromise.
Why it matters for trust and compliance
- The exploit demonstrates a gap in the access‑control control objective, reminding organizations to verify that authentication mechanisms enforce strong, verifiable credentials and that logs are retained for audit evidence.
- Validate SSH authentication configurations against the control objective of enforcing strong authentication and password policies.
- Collect and retain detailed SSH login logs to provide defensible evidence for access‑control compliance.
Who is affected
CLOUD_INFRA TECH_SAAS
Recommended actions
- Patch OpenSSH to version 10.6p2 or later on all affected systems.
- Review and harden SSH daemon settings; disable password‑less accounts or enforce key‑based authentication.
- Enable comprehensive SSH logging and integrate alerts into your SIEM.
- Map your SSH access controls to the relevant control objective and capture evidence for audit readiness.
Details
- CVEs
- CVE-2026-123158