CVE-2026-123158 SSHole Exploited on Alpine Linux Honeypot Nine Hours After Disclosure

The vulnerability stems from a 2016 username-enumeration fix that mishandles password hashing failures on musl-based systems. When an attacker supplies a 257-1024 byte password, the failed hash produces an asterisk that matches the disabled-password marker, granting access without valid credentials. Only accounts explicitly set to * are affected; glibc and PAM-enabled deployments remain untouched. This configuration is default on Alpine containers and minimal images, expanding the attack surface beyond what the original report quantified.

Telemetry from the single Japanese IP shows immediate post-disclosure scanning followed by reconnaissance commands via non-interactive sessions. Honeypot success confirms weaponization speed rather than sophisticated targeting. No independent technical attribution exists beyond geolocation; claims of broader campaigns lack packet or binary evidence at this stage. The rapid timeline aligns with patterns seen in prior high-severity auth flaws where public PoC release compresses defender windows.

Enterprises must audit Alpine instances for "Accepted password" logs on key-only or disabled accounts, then deploy OpenSSH 10.6p2 immediately. Procurement records for container orchestration platforms show heavy Alpine reliance, indicating lateral-movement risk if root is obtained. Continued monitoring of the same IP range and similar musl fingerprints will reveal whether this is isolated scanning or the start of sustained campaigns.