SSHole OpenSSH Vulnerability CVE-2026-123158: CISA Adds It to the Exploited List With GPUStack, FreeSWITCH and IBM Aspera Faspex Flaws, and the Fixed Versions to Install

CISA has added four flaws that attackers are already exploiting to its Known Exploited Vulnerabilities (KEV) list. The one most businesses should check first is SSHole (CVE-2026-123158), a password bypass in OpenSSH on some Linux servers. If you run Alpine Linux servers or containers with SSH turned on, or GPUStack, FreeSWITCH or IBM Aspera Faspex, check your versions this week.

What CISA added on November 9, 2026

CISA added these four CVEs to the KEV catalog on Monday, November 9, 2026. The catalog gives US federal civilian agencies a due date of Thursday, November 12, 2026, and lists known ransomware use as "Unknown" for all four. That deadline only binds federal agencies, but it tells everyone else how urgent CISA thinks these are.

What is the SSHole OpenSSH vulnerability?

OpenSSH released version 10.6p2 on November 5, 2026, to fix a password authentication bypass. The release notes say it affects some Linux systems built and run with PAM support disabled, and the summary names Linux systems that use the musl C library with PAM disabled. PAM is the login framework most Linux systems use to check passwords. OpenSSH says the root cause is outside sshd but can be blocked inside it, so that is where the fix went. The bug was reported by Özgün Kültekin of Wakefield.

Alpine Linux's security tracker describes the problem this way: "For some configurations of accounts, any password between 256 and 1024 characters succeeds." GreyNoise, which tracked the attacks, says the flaw lets "an oversized password authenticate to accounts configured to reject password logins" and that working exploits are publicly available.

Is my server affected by SSHole?

Check these conditions:

• Linux with musl libc. Alpine Linux is the best-known musl distribution, and GreyNoise names it directly.
• OpenSSH built and run without PAM.
• SSH reachable from a network an attacker can reach, most of all the internet.

Mainstream glibc distributions such as Ubuntu, Debian and Red Hat do not match the conditions OpenSSH describes, but check your vendor's advisory to be sure. Look closely at Docker images built on Alpine that run sshd, and at appliances built on Alpine.

Not known: OpenSSH and CISA do not publish a list of other distributions or appliances that are affected.

What attackers have done with SSHole: confirmed and not confirmed

GreyNoise watched attacks against its own sensor network and published a running report. As of its November 10 update, it confirms the following:

• First successful exploitation at 00:46:51 UTC on November 7, 2026, two days after the fix came out.
• 18 successful exploitation chains from 6 attacker IP addresses.
• Attempted credential theft. In one session, the attacker checked for containers and cloud metadata services and tried to read root's SSH keys and /etc/shadow using doas. The report does not show those reads succeeding, and GreyNoise says this attacker "wrote no files and installed no tools."
• An implant was uploaded, but never connected. On another sensor, an attacker uploaded a Python implant called TAC Agent, which is built to take commands from a control server. GreyNoise says it never managed to enroll with that server. A startup script, /etc/init.d/tac-agent, was written on a different sensor.
• Backdoor keys. Sessions GreyNoise did not tie to any one attacker added entries to authorized_keys files on two sensors. A key like that lets the attacker back in even after you patch.

Not known: how many real business servers have been hit. GreyNoise's numbers come only from its own sensors, and we found no primary source counting real victims.

The other three exploited flaws

GPUStack CVE-2026-102895

GPUStack manages AI model servers. Its advisory, published July 31, 2026, says versions before 2.2.0 treat any request that appears to come from the machine itself as the built-in administrator. That happens when a reverse proxy runs on the same host, or when a client sends a forged X-GPUStack-Real-IP: 127.0.0.1 header. An attacker gets full admin with no login. That includes creating admin API keys, reading worker and cloud provider secrets, and possibly running code on worker hosts. The advisory reports in-the-wild exploitation against a version 2.1.1 deployment. Fix: upgrade to 2.2.0. Workaround: set force_auth_localhost=true and strip that header at your proxy.

FreeSWITCH CVE-2026-116779

FreeSWITCH is open source phone system software. The SignalWire advisory, published October 28, 2026, says one inbound SIP MESSAGE can make version 1.11.2 and earlier run FreeSWITCH API commands, including operating system commands. Chat is on by default, and the stock configuration includes a default user with no password. The advisory says exploitation has been seen in the wild, but gives no detail on who is behind it or how widespread it is. Fix: upgrade to 1.11.3. Workaround: set enable-chat=false on every SIP profile that does not need chat. The advisory says tightening the ACL or relying on auth-messages alone does not close the hole.

IBM Aspera Faspex CVE-2026-123218

IBM's bulletin, published November 7, 2026, says a logged-in user of Faspex 5.0.0 through 5.0.19 can craft a message that grants "full administrative privileges." IBM rates it 9.8. Fix: 5.0.19 PL1 on Linux, confirming the faspex-core image shows Fix Pack 1. IBM lists no workaround. There are no public details on how this flaw is being exploited.

What to do this week

• List every server and container that runs sshd, and note which ones are Alpine or another musl-based system (cat /etc/os-release).
• On Alpine, check the package: apk list --installed | grep openssh, then apk update && apk upgrade. Alpine's fixed versions include 10.6_p2-r0 (edge), 10.3_p1-r2 (3.24), 10.2_p1-r1 (3.23), 10.0_p1-r11 (3.22), 9.9_p2-r1 (3.21) and 9.7_p1-r6 (3.20).
• Rebuild container images based on Alpine that include sshd, and redeploy them. Updating a running container is not enough.
• Keep SSH off the open internet where you can, and put it behind a VPN or an allow-list.
• Look for signs of compromise: unknown entries in any authorized_keys file (GreyNoise saw key comments "SSHHOLE-HIT" and "fleet-access"), /opt/py3, /etc/init.d/tac-agent, and traffic to tac.vpnla.org.
• Upgrade GPUStack to 2.2.0, FreeSWITCH to 1.11.3 and Faspex to 5.0.19 PL1, and apply the workarounds above until you can.
• If you find anything suspicious, rotate credentials stored on that machine, including cloud keys and API tokens.

Why it matters for a business network or website

SSH is the admin door to the servers that run websites, apps, databases and backups. Alpine is a popular base for lightweight containers, so an SSH service a developer added to an image years ago can end up running in production without anyone tracking it. The other three products do business-critical work: Faspex moves large files between companies and their clients, FreeSWITCH runs phone systems, and GPUStack sits next to AI models and cloud credentials. A break-in on any of them gives an attacker a foothold inside your network. If you host your own infrastructure, knowing what runs where is the first defense; see our self-hosting and infrastructure service.

SSHole questions people are asking

What is SSHole?

SSHole is the name for CVE-2026-123158, a password authentication bypass in OpenSSH on Linux systems using musl libc with PAM disabled. It is fixed in OpenSSH 10.6p2.

Is Ubuntu or Debian affected by SSHole?

They use glibc, not musl, so they do not match the conditions OpenSSH describes. Check your vendor's advisory to confirm.

Does turning off password login protect me?

Do not count on it. GreyNoise says the exploit worked against accounts configured to reject password logins, and the only remedy OpenSSH documents is upgrading.

What is the CISA KEV deadline for these four flaws?

November 12, 2026, for US federal civilian agencies. For everyone else, it is a sign to treat these as urgent.

Is there a workaround for IBM Aspera Faspex CVE-2026-123218?

No. IBM says to upgrade to 5.0.19 PL1.

Is patching enough if I was already attacked?

No. A patch does not remove an SSH key or startup service an attacker added. Check for the signs listed above.

The bigger lesson

The OpenSSH fix came out two days before GreyNoise saw the first successful attack. The businesses that stay safe are the ones that already know which servers and containers run which software, so a patch is a quick job and not a hunt.

Want someone to review and harden your servers? See security hardening or get a quote.

Get security alerts by email, with the free checklist, at our security alerts page.

Sources: CISA KEV alert; CISA KEV catalog; OpenSSH release notes; GreyNoise SSHole report; Alpine security tracker; GPUStack advisory; FreeSWITCH advisory; IBM security bulletin.