SSHOLE OpenSSH Password Bypass Exposure and Honeypot Source IP Hunt (CVE-2026-123158)

Goksel Atakan@gokselatakan

•updated yesterday•20•0•48

Detects successful SSH connections and logons from source IPs seen in SANS ISC honeypot data for the sshole OpenSSH password authentication bypass, and lists Alpine Linux hosts that may be exposed. Alpine is not an officially supported Defender for Endpoint platform, so an empty result does not prove absence, and the long password is not visible in telemetry.