🔍 Read the full analysis: How The OpenSSH SSHole Bug Puts Some Linux Servers At Risk on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
The SSHole flaw, tracked as CVE-2026-123158, can let an attacker log in to certain accounts on Linux servers when several specific OpenSSH and musl conditions are met. OpenSSH released version 10.6p2 on November 5, 2026; public exploit code and observed exploitation followed, and CISA added the vulnerability to its exploited-vulnerabilities list. Administrators should update and restart sshd, or disable password authentication if they cannot update.
A flaw in OpenSSH can allow passwordless login to accounts on some Linux servers when the server uses musl libc, checks passwords without PAM and has password authentication enabled, according to advisories from Alpine Linux and OpenSSH. Tracked as CVE-2026-123158 and rated High at 8.1, the bug was fixed in OpenSSH 10.6p2 on November 5; public exploit code and a reported successful break-in followed, raising concern for administrators of affected systems.
The bug, dubbed “SSHole” by its finder, arises from how some configurations handle an unusually long password. Alpine Linux says musl’s crypt() function returns the string * as an error indicator when a password exceeds 256 bytes. Some accounts that should not accept password logins have * in the stored password field. In the affected setup, the error value can match that field, and sshd may accept the login. The reported password length range is 257 to 1,024 bytes.
The attack requires a specific combination of conditions, not merely an OpenSSH installation. The server must run Linux with musl, use an sshd configuration that checks passwords without PAM, and have PasswordAuthentication enabled. It also needs an account with a * password field and at least one local account with a $5$ or $6$ password hash. Alpine says the latter account supplies a salt used in the check. Alpine’s standard openssh-server package is a prominent example of an affected configuration.
OpenSSH released version 10.6p2 to address the issue. GreyNoise and BleepingComputer reported that exploit code appeared about four hours after the release, and GreyNoise said one of its sensors recorded a successful break-in about 40 hours after release. CISA added the vulnerability to its list of exploited vulnerabilities on November 9. Administrators are advised to install the fixed package and restart sshd; Alpine warns that upgrading alone does not replace an already-running daemon.
The OpenSSH SSHole bug puts some Linux servers at risk
A password-check flaw can allow login to certain accounts without a valid password. Exposure depends on a specific combination of Linux, musl, SSH settings and account conditions.
When systems are exposed
The bypass requires all of these conditions to be present.
The server uses musl libc.
The sshd configuration checks passwords without PAM, and password authentication is enabled.
A target account has a * password field, and a local account has a $5$ or $6$ password hash.
How the bypass works
An unusually long password can trigger an error value that matches a locked account’s stored field.
Who should check
Linux systems are not all affected; verify the actual libc and SSH configuration.
- Alpine Linux and its standard openssh-server package
- Some embedded or custom builds using musl, including systems built with OpenWrt, Buildroot or Yocto
- Qualifying Alpine tiny-cloud images after a $6$ password hash exists
- Ubuntu OpenSSH builds use glibc and PAM
- Red Hat says its products are unaffected
- Project names alone do not establish that every custom build is vulnerable
What administrators should do
Patch and make sure the running SSH service uses the fixed code.
- Check whether servers use musl and password checks without PAM.
- Install OpenSSH 10.6p2 or a vendor-provided fixed package, then restart sshd.
- If unable to update promptly, disable PasswordAuthentication and restart or reload the service as appropriate.
- Review authentication logs for password logins to accounts with no password, and assess their privileges.
Why Affected Servers Need Prompt Patching
The flaw matters because it can turn an account that is meant to be inaccessible through passwords into a route into a reachable SSH server. SSH is a common remote administration service, so a vulnerable, internet-accessible host may provide an attacker an entry point without a valid password for the targeted account. Alpine characterizes the bypass as requiring one connection rather than repeated guesses, though the required system and account conditions substantially limit exposure.
Risk is not evenly distributed across Linux systems. Ubuntu says its OpenSSH builds use glibc and PAM and are not vulnerable; Red Hat also says its products are unaffected. The reported vulnerability is more relevant to Alpine and some embedded or custom Linux builds, including configurations built with OpenWrt, Buildroot or Yocto. Device operators may have less direct visibility into which libc and SSH configuration their vendor image uses, making inventory and vendor guidance important.
A successful login does not automatically mean an attacker has root access. OpenSSH’s default root-login setting blocks root password authentication, but Alpine warns that a compromised account may still gain elevated privileges if it can use tools such as passwordless doas. The practical impact therefore depends on the account and privileges present on each host.
Popular right now
Breville Barista Touch Impress Espresso Machine, Noir (BES881NRE)
Shark NV752 Rotator Powered Lift-Away TruePet Upright Vacuum, Bordeaux
KitchenAid Artisan 5-Quart Tilt-Head Stand Mixer, Blue Velvet
As an affiliate, we earn on qualifying purchases.
How the Password Check Fails
On systems that use password hashes, an account locked against password login may have a marker such as * in its password field. In the affected non-PAM path, sshd passes the supplied password to the C library’s crypt() function and compares the result with the stored field. Alpine’s advisory says musl returns * for an input over 256 bytes as an error indicator, creating the match that enables the bypass.
Responsibility for the underlying behavior has been disputed. OpenSSH says the root cause is outside sshd, while noting that the issue is exploitable through sshd and can be avoided there. Musl maintainer Rich Felker said on the project’s mailing list that he viewed the behavior as an erroneous use by the caller, rather than a musl bug, and said musl may change the mechanism in a future release cycle. OpenSSH 10.6p2 is the available fix cited in the source material.
Some Alpine cloud images need particular attention. Alpine says its official tiny-cloud images from versions 3.18.11 through 3.24.3 include an alpine account with a * password field and passwordless doas. The advisory says these images are safe on first boot but can become exploitable once a qualifying $6$ password hash exists on the machine.
““musl’s crypt() returns the string * as an error indicator when the key is over 256 bytes long.””
— Alpine Linux security advisory
Which Custom Builds Are Exposed
The stated prerequisites make exposure configuration-specific, and the available material does not identify every affected device, server image or downstream package. Alpine is the best-known case, while the researcher also named OpenWrt, Buildroot and Yocto; those names alone do not establish that every system built with them is vulnerable. Medcrypt reported reproducing the issue on a stock Yocto image, but the full range of affected vendor products remains unclear.
It is also not clear from the cited reports how many systems have been compromised. GreyNoise reported a successful event on one of its sensors, while CISA’s listing confirms the flaw is treated as exploited; neither fact provides a count of affected servers or victims. OpenSSH and musl also differ over whether the underlying cause belongs to the library or its caller, although OpenSSH’s patched release provides a mitigation.
Update, Restart and Check Logs
Administrators should first determine whether their servers use musl and whether sshd checks passwords without PAM. If the configuration may meet the listed conditions, install OpenSSH 10.6p2 or a vendor-provided fixed package, then restart sshd so the running service uses the patched code. Alpine says fixed packages are available across its listed branches, including branches no longer receiving regular updates.
If an update cannot be applied promptly, Alpine’s guidance is to set PasswordAuthentication no and restart or reload the service as appropriate for the system. Administrators should also review authentication logs for password logins to accounts that have no password, and assess whether any such account could gain additional privileges. Distribution and device vendors may provide package-specific instructions; the cited material does not set a single deadline for all systems.
Key Questions
Can the SSHole flaw affect every Linux server?
No. The reported bypass requires a particular combination: Linux with musl libc, OpenSSH checking passwords without PAM, password authentication enabled, an account with a * password field and a local $5$ or $6$ password hash.
Are Ubuntu and Red Hat systems affected?
Ubuntu says its OpenSSH builds use glibc and PAM and are not vulnerable. Red Hat says its products are not affected. Administrators should still follow the relevant vendor’s security notices for their specific packages.
What version fixes CVE-2026-123158?
OpenSSH 10.6p2 is the upstream fixed version cited in the source material. Some distributions may supply a fixed package through their own versioning and update channels.
What should administrators do if they cannot update now?
Alpine recommends setting PasswordAuthentication no as a workaround. Administrators should also restart the SSH service as needed and review logs for suspicious password logins to accounts intended to be password-locked.
Does a successful login mean the attacker becomes root?
Not automatically. OpenSSH’s default root-login setting blocks root password authentication, but Alpine warns that a compromised account could gain elevated privileges through tools such as passwordless doas, depending on the system’s configuration.
Source: ThorstenMeyerAI.com
