Summary

This week brought a flood of advisories: OpenSSH has a passwordless-login bug that was already being exploited within hours of being announced, the WordPress InfiniteWP Client plugin turns out to store a signing key that can be recovered offline in a matter of minutes, and Apache released three CVEs at once for Axis2/Java plus one for Allura. The most urgent to check first: Linux OpenSSH servers with musl + PAM disabled, WordPress sites using InfiniteWP Client in NOSSL mode, and Tryton installations — all three have proven, working exploitation paths.

1. OpenSSH "SSHole" — passwordless login, already actively exploited

Affected: Linux systems running OpenSSH on top of the musl C library with Pluggable Authentication Modules (PAM) disabled. CVE: CVE-2026-123158 (CVSS 8.1), dubbed SSHole (*sshole). Impact: allows sign-in to accounts that have no password at all. According to Previdian, attackers were already attempting this exploit within hours of disclosure and succeeded in gaining root on a honeypot. Action now: check whether your systems use the musl + PAM disabled combination, then apply the official patch from your distro/OpenSSH as soon as it's available. The Hacker News

2. InfiniteWP Client — NOSSL signing key has only 31 bits of secret

Affected: InfiniteWP Client 1.13.10, a WordPress management plugin with roughly 200,000 installations, on sites registered via the NOSSL authentication mode (rather than the RSA path). Impact: the NOSSL signing key is formed from md5(base64_encode(panel_public_key) . rand(0, getrandmax())) — the secret is just a single rand() output, with a maximum of 2^31 possibilities. A researcher (knell) demonstrated that the key can be recovered offline in just 291.9 seconds from a single captured get_stats request, then used to forge a maintain_site command that the server accepts and that writes a new database option. This key is never rotated, so once recovered it can be used to forge requests forever. Action now: the article doesn't mention an official fix version, so check whether your site is registered in NOSSL mode and watch the vendor advisory for a patch; the proportion of installations using NOSSL out of the ~200,000 total is not known externally. oss-security mailing list

3. Apache Allura — OAuth1 rebinding (critical)

Affected: Apache Allura up to version 1.22.0. CVE: CVE-2026-118196, critical severity. Impact: an OAuth1 rebinding vulnerability; the advisory does not explain the exploitation scenario in detail. Action now: upgrade to Apache Allura 1.22.1. oss-security mailing list

4. Tryton (trytond) — wizard without model/group restriction

Affected: trytond series 8.2 (<= 8.2.1), 8.0 (<= 8.0.12), 7.8 (<= 7.8.18), 7.0 (<= 7.0.59). CVSS: 8.1 (Network, Low complexity, Low privileges required, no user interaction, confidentiality High, integrity High). Impact: there is no restriction preventing a wizard from being run without any model or group. Action now: upgrade trytond to the fixed version (8.2.2 / 8.0.13 / 7.8.19 / 7.0.60) and make sure no unwanted user was created in the meantime. As an additional workaround, add at least one group to the registered wizard via Administration / User Interface / Actions / Wizards — this also needs to be redone after updating. Tryton News

5. CPython — regression in FIPS enforcement for hash algorithms

Affected: Python 3.14.10 only. CVE: CVE-2026-119170, HIGH severity. Impact: a regression in FIPS enforcement for hash algorithms; the exploitation scenario is not detailed in this forward advisory. Action now: check the CVE record and PR cpython/pull/160984 for the latest affected/fixed versions before running 3.14.10 in an environment that requires FIPS. oss-security mailing list

6. Apache Axis2/Java — XXE via WSDL/XSD import

Affected: Apache Axis2/Java before 2.0.2. CVE: CVE-2026-120761, important severity. Impact: when a client builds an AxisService from a WSDL URL via ServiceClient or AxisService.createClientSideAxisService, wsdl4j's import resolution processes wsdl:import/xsd:import documents with a parser that accepts DOCTYPE and external entities — an attacker who controls the WSDL or a document it imports can read local files or force the JVM to make a network request. Action now: upgrade to Apache Axis2/Java 2.0.2. oss-security mailing list

7. Apache Axis2/Java — SSRF via WS-Addressing ReplyTo/FaultTo

Affected: Apache Axis2/Java before 2.0.2. CVE: CVE-2026-123753, important severity. Impact: an unauthenticated caller can set a non-anonymous wsa:ReplyTo or wsa:FaultTo, causing Axis2 to open a connection to that address to send the response/fault — which can reach internal hosts and send the response content to a host of the attacker's choosing. Action now: upgrade to 2.0.2 — starting with this version, decoupled responses are rejected unless allowNonAnonymousResponseEndpoints is enabled, and allowed endpoints are restricted by scheme and checked at the header-parsing and transport-selection layers. oss-security mailing list

8. Apache Axis2/Java — SSRF via WSDL/XSD schema import resolution

Affected: Apache Axis2/Java before 2.0.2. CVE: CVE-2026-120832, moderate severity. Impact: when Axis2 builds a service description from a WSDL via ServiceClient, AxisService.createClientSideAxisService, or WSDLToAxisServiceBuilder, absolute URLs in wsdl:import and in schemaLocation on xsd:import/xsd:include are fetched without any scheme or host restriction — including via the AAR and WAR deployment resolvers — so the JVM can be forced to send a request to an arbitrary host, internal or external. Action now: upgrade to Apache Axis2/Java 2.0.2. oss-security mailing list

Checklist

  • [ ] Check Linux servers running OpenSSH on musl + PAM disabled, watch for a patch for CVE-2026-123158
  • [ ] Check whether WordPress sites use InfiniteWP Client in NOSSL mode, watch the vendor advisory
  • [ ] Upgrade Apache Allura to 1.22.1 (CVE-2026-118196)
  • [ ] Upgrade trytond to the fixed version for your series (8.2.2 / 8.0.13 / 7.8.19 / 7.0.60), audit for new users, and set a group on the wizard related to issue 15205
  • [ ] Review use of Python 3.14.10 in FIPS environments, check CVE-2026-119170 for the latest fix version
  • [ ] Upgrade Apache Axis2/Java to 2.0.2 to close CVE-2026-120761, CVE-2026-123753, and CVE-2026-120832 all at once

---

Sources summarized:

Read also