Attackers are actively exploiting the SSHole vulnerability in OpenSSH, according to multiple cybersecurity companies. The flaw enables unauthorized login on certain systems by using a password exceeding 256 characters against accounts that should not accept passwords at all.
The vulnerability impacts Linux distributions relying on the musl library, specifically Alpine Linux, OpenWRT, Buildroot, and Yocto. It does not reside directly in OpenSSH code but stems from an interaction with the musl environment. A new release, OpenSSH 10.6p2, was issued on November 5, 2026, containing a mitigation after the issue was reported on November 4.
Successful exploitation requires several conditions: the OpenSSH daemon must run on musl, PAM must be disabled, password authentication must remain enabled, an account must exist with only an asterisk as its password, and another account with a real password must be present on the system.
Cybersecurity firm Previdian observed the first attacks nine hours after the patch became available. watchTowr also confirmed active exploitation, noting that attackers are using the flaw to add compromised systems to botnets or to install cryptominers that abuse the machines' resources for cryptocurrency mining.
The Nationaal Cyber Security Centrum advises against exposing SSH management services directly to the internet and recommends restricting access to trusted networks while disabling password authentication when it is not required.
