OpenSSH “SSHole” (CVE‑2026‑123158) Enables Password‑less Root Access on Linux Systems

O que aconteceu

CVE‑2026‑123158, dubbed *sshole*, affects OpenSSH binaries built against the musl C library when PAM is turned off. The flaw bypasses password checks, allowing an attacker to authenticate as any user that has no password set. Within hours of disclosure, threat actors scanned the internet, successfully exploiting a honeypot and gaining root privileges. The OpenSSH project released a patch; administrators must apply it and re‑enable PAM or enforce password policies.

Por que isso importa para confiança e conformidade

• The flaw directly challenges the access‑control control objective—ensuring authentication mechanisms enforce strong credentials—an area mapped across NIST CSF 2.0, ISO 27001, and other frameworks.
• Demonstrates the need for continuous monitoring of authentication logs as evidence of control effectiveness.
• Supports audit readiness by showing that password policies are enforced and exceptions are documented.

Who is affected

Recommended actions

1. Apply the OpenSSH security patch immediately.
2. Re‑enable PAM or enforce mandatory password policies for all local accounts.
3. Audit existing accounts for empty passwords and remediate.
4. Enable detailed logging of authentication attempts and integrate logs into a SIEM for continuous monitoring.

Detalhes

CVEs

CVE-2026-123158