OpenSSH SSHole Flaw Allows Root Access

A newly disclosed vulnerability in OpenSSH, codenamed “SSHole,” lets attackers log into accounts that have no password set, potentially giving them full root access. The flaw is tracked as CVE‑2026‑123158 and has a CVSS score of 8.1 ¹.

It targets Linux machines running OpenSSH compiled against the musl C library when Plug‑in Authentication Modules (PAM) are disabled. In such environments, an attacker who discovers or guesses a valid username can authenticate without providing any credential, bypassing all traditional login checks ¹.

Security researcher Previdian said threat actors began targeting this weakness within hours of its public disclosure, focusing initially on honeypot servers set up to attract exploitation attempts. By leveraging the absence of password requirements, they were able to elevate privileges to root level, granting complete control over the compromised host ¹.

The issue arises from a misconfiguration where the SSH server fails to enforce mandatory password verification if PAM is turned off. This oversight allows the server to accept empty password fields as legitimate credentials, opening a backdoor for anyone who knows a user name ¹.

The discovery shows how subtle configuration choices can create critical gaps in otherwise robust software. While the vulnerability has not yet been widely exploited beyond controlled testing environments, its high CVSS score and straightforward bypass mechanism raise concerns about potential large-scale attacks against poorly configured servers across the internet ¹.

OpenSSH’s “SSHole” flaw provides attackers with a simple path to root on vulnerable Linux systems, underscoring the need for vigilant configuration management.