🔍 Read the full analysis: OpenSSH SSHole Bug: Where Overlong Passwords Meet Server Security on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
CVE-2026-123158, dubbed “SSHole,” can allow passwordless SSH access under a narrow set of Linux configurations using musl, OpenSSH without PAM and password authentication. OpenSSH released version 10.6p2 on November 5, 2026; exploit code followed about four hours later, and GreyNoise reported a successful break-in on a sensor about 40 hours after the release. Affected administrators should install the fix, restart sshd and review authentication logs.
OpenSSH released version 10.6p2 on November 5 to fix a flaw that can let attackers log in without a valid password on certain Linux servers. Tracked as CVE-2026-123158 and dubbed “SSHole” by its finder, the bug affects a specific combination of musl, OpenSSH password authentication and accounts with a particular locked-password field; public exploit code appeared about four hours after the fix, according to GreyNoise and BleepingComputer.
The bypass requires several conditions to coincide: Linux using the musl C library, an OpenSSH server that checks passwords without PAM, and password authentication enabled. A targeted account must have an asterisk (*) in its password field, and the system must also have at least one local account with a $5$ or $6$ password hash. Alpine Linux is the best-known affected case, though the researcher also identified possible deployments using OpenWrt, Buildroot and Yocto.
Alpine’s advisory says musl’s crypt() function returns * as an error indicator when given a password longer than 256 bytes. In the affected setup, that error value matches the stored field for accounts that should not accept password logins. An attacker can send an overlong password and cause the comparison to succeed. Alpine says the attack needs one connection and no retries. OpenSSH’s release notes place the root cause outside sshd while noting that the server can avoid the unsafe behavior.
The flaw carries a High rating of 8.1, according to the supplied source material. GreyNoise and BleepingComputer reported public exploit code roughly four hours after OpenSSH’s release, while GreyNoise recorded a successful break-in on one of its sensors about 40 hours after the release. CISA added CVE-2026-123158 to its list of exploited vulnerabilities on November 9. Those reports establish observed exploitation, but do not establish how many systems were compromised.
OpenSSH SSHole Bug Where overlong passwords meet server security
CVE-2026-123158 can bypass password checks on a narrow set of musl-based Linux systems. Administrators should verify exposure, install a fix, restart sshd and review authentication logs.
When the bypass can work
Several local conditions must coincide; the flaw does not affect every OpenSSH server.
Linux uses musl, as in the best-known Alpine Linux case.
Password authentication is enabled and sshd checks passwords without PAM.
The target account has an asterisk password field, and a local account has a $5$ or $6$ hash.
A password longer than 256 bytes can make musl crypt() return an error marker that matches the asterisk field.
Reported activity
Exploit code appeared quickly, and exploitation was reported; the reports do not establish a victim count.
What operators should check
- Alpine Linux and musl-based builds
- OpenWrt, Buildroot and Yocto configurations may warrant checks
- Alpine tiny-cloud images 3.18.11 through 3.24.3 need specific review
- Debian, Ubuntu and Red Hat reported their builds are not affected
- Ubuntu cited glibc and PAM
- Debian lists the upstream fixed version in its unstable branch
Patch and investigate
Complete each step for systems that may meet the conditions.
- Install OpenSSH 10.6p2 or the distribution-provided fixed package.
- Restart sshd so the running daemon uses the updated code.
- If an update is delayed, consider setting PasswordAuthentication no where compatible with access needs.
- Review authentication logs for password logins to accounts that should not accept passwords.
- Check whether affected accounts can gain elevated privileges and consult the vendor advisory for the exact build.
Why SSH Password Bypasses Matter
SSH is a common way for administrators to reach servers remotely. On a system that meets the vulnerability’s conditions, an exposed SSH service could provide an attacker access to an account without the account’s password. The risk can extend beyond that account: Alpine warns that a user able to gain elevated privileges—for example, through passwordless doas—could potentially reach root.
The issue is especially relevant to Alpine installations and embedded Linux devices, where administrators may use musl-based builds rather than the configurations found in major desktop and server distributions. The narrow prerequisites limit the affected population, but the rapid appearance of exploit code and a reported successful attempt make prompt checks worthwhile for operators who cannot rule out those conditions.
Installing the package is not the only step: Alpine says administrators must restart sshd for the running daemon to use the updated code. Reviewing logs for password logins to accounts that should not have passwords can help identify suspicious activity; the source material does not provide a universal log signature or a count of confirmed victims.
Products Worth Considering
Apple MacBook Pro 16.3-inch with PROLED XDR Display, Silver
LG UltraGear 27-inch QHD OLED Gaming Monitor, 240Hz
Ledger Flex Crypto Wallet with 2.8-Inch E Ink Touchscreen
As an affiliate, we earn on qualifying purchases.
How the Asterisk Match Occurs
Linux account records may use * in place of a password hash to prevent password login. According to Alpine, the vulnerable path arises when sshd checks a password without PAM and calls musl’s crypt(). For an input over 256 bytes, the library’s error marker can be identical to the account’s stored value. The issue therefore depends on both the input length and the account configuration, rather than affecting every OpenSSH login.
OpenSSH said the problem could be avoided in sshd, while musl maintainer Rich Felker argued on the project’s mailing list that the caller was using the library incorrectly. Felker said musl would very likely change the mechanism in an upcoming release cycle. The supplied material says Debian, Ubuntu and Red Hat reported their builds are not affected: Ubuntu cited its use of glibc and PAM, and Red Hat said its products are not affected. Debian’s tracker lists the upstream fixed version in its unstable branch.
Alpine’s official tiny-cloud images from versions 3.18.11 through 3.24.3 are a specific concern: the advisory says they include an alpine account with a * password field and passwordless doas. Alpine says these images are safe on first boot but can become exploitable once a $6$ hash exists on the machine. OpenWrt, Buildroot and Yocto configurations may also warrant checks; a Medcrypt report on the oss-security mailing list said the flaw was reproduced on a stock Yocto image.
“An attacker who can reach your SSH port can log in without knowing any password. It takes one connection, works every time, and needs no retries.”
— Alpine Linux security advisory
Exposure Depends on Local Configuration
The vulnerability does not affect every OpenSSH server, and the number of exposed or compromised systems is not known from the supplied reports. Administrators need to verify the operating system’s C library, whether sshd uses PAM, whether password authentication is enabled, the relevant account password fields and the presence of a qualifying local hash.
Exposure across embedded Linux builds remains less settled than for the distributions that issued statements. Medcrypt reported reproducing the issue on a stock Yocto image, but the source material gives no inventory of affected products or deployments. The supplied information also does not detail the sensor incident, identify its operator or confirm whether the reported access led to further activity. The disagreement between OpenSSH and the musl maintainer over root cause remains unresolved.
Patch, Restart and Review Logs
Administrators should install OpenSSH 10.6p2 or a distribution-provided fixed package and restart the SSH daemon; updating files without restarting may leave the old daemon running. Alpine says fixed packages were published for branches from edge back to 3.16. Where an update cannot be applied promptly, the source recommends setting PasswordAuthentication no, if compatible with the system’s access requirements.
Operators should check authentication logs for password logins to accounts that should not accept passwords, and review whether affected accounts can gain elevated privileges. They should also check vendor advisories for their exact distribution or device build. Further guidance may follow from Linux distributors, embedded-system vendors and the musl project; the supplied source does not give a timetable for additional advisories or for a musl change.
Key Questions
Which systems are affected by SSHole?
Only systems meeting a combination of conditions: Linux with musl, OpenSSH checking passwords without PAM, password authentication enabled, an account with a * password field, and at least one local $5$ or $6$ password hash. Alpine is the best-known affected distribution.
Are Debian, Ubuntu and Red Hat affected?
The supplied material says these distributions reported their OpenSSH builds are not affected. Ubuntu cited its use of glibc and PAM; Red Hat said its products are not affected. Check the relevant vendor advisory for the precise package and version in use.
What should an administrator do first?
Install OpenSSH 10.6p2 or the vendor’s fixed package, then restart sshd so the running daemon uses the update. If patching is delayed, disabling password authentication is a mitigation where operationally suitable.
Does a very long password alone make every SSH server vulnerable?
No. The overlong input triggers the problematic behavior only in the specified musl and OpenSSH configuration, with the required account fields and password hash present. The source describes inputs over 256 bytes; it does not say all SSH servers accept or mishandle them.
Is there evidence the flaw has been exploited?
GreyNoise reported a successful break-in on one of its sensors about 40 hours after the fix was released. CISA added the flaw to its exploited-vulnerabilities list on November 9, 2026. The supplied material does not state how many systems were affected overall.
Source: ThorstenMeyerAI.com
