🔍 Read the full analysis: OpenSSH SSHole: An Overlong-Password Bug Affecting Some Linux Servers on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A flaw in OpenSSH can let an attacker bypass password checks on certain Linux servers using musl libc, if several configuration conditions are met. OpenSSH released a fix in version 10.6p2 on Nov. 5, 2026; public exploit code followed about four hours later, and GreyNoise reported a successful attack on a sensor about 40 hours after release. Administrators should update and restart sshd, or disable password authentication if they cannot update, and review logs for suspicious logins.
OpenSSH released version 10.6p2 on Nov. 5 to fix a password-bypass vulnerability, tracked as CVE-2026-123158, that can affect certain Linux servers using the musl C library. The flaw, dubbed “sshole” by its finder, requires a specific combination of server, account and authentication settings; it does not affect all Linux or OpenSSH systems.
The issue occurs when sshd checks passwords without PAM on an affected musl-based Linux system. According to Alpine Linux’s advisory, musl’s crypt() function returns an asterisk when the supplied password exceeds 256 bytes. On systems where an account’s stored password field is also an asterisk, the error value can match that field and lead sshd to accept the login. The advisory says a password from 257 to 1,024 bytes can trigger the bypass.
The conditions must align: sshd must run on Linux with musl, password authentication must be enabled, password checks must happen without PAM, and the system must have an account with an asterisk in its password field. Alpine also says at least one local account must have a $5$ or $6$ password hash. Accounts without passwords can include key-only users and, in some configurations, root or a default cloud-image user.
Exploit code became public about four hours after the fix, according to GreyNoise and BleepingComputer. GreyNoise reported its first successful break-in on a sensor about 40 hours after OpenSSH published the update. CISA added the vulnerability to its list of exploited vulnerabilities on Nov. 9. These reports indicate observed exploitation, but do not establish how many real-world servers have been compromised.
OpenSSH SSHole A targeted password bypass
A flaw can let attackers bypass password checks on certain musl-based Linux servers. Exposure depends on a specific combination of account and SSH settings.
When systems are exposed
All listed conditions must align for the bypass to work.
Linux server using musl libc.
Password authentication is enabled and checks run without PAM.
An account has an asterisk in its stored password field, with a qualifying password hash present.
Why the check can fail
Without PAM, sshd uses musl’s crypt() function to check the supplied password.
- For passwords over 256 bytes, musl crypt() returns an asterisk error value.
- In the affected account setup, that value can match the stored field.
- sshd may accept the login without a valid password.
- The flaw requires the specific server, authentication and account conditions.
Reports and affected builds
Reports confirm observed exploitation but do not establish how many servers were compromised.
What administrators should do
Check the actual system configuration; a distribution name alone does not establish exposure.
- Install OpenSSH 10.6p2 or a distribution package containing the fix, then restart sshd.
- If you cannot update promptly, disable password authentication if that fits your access needs.
- Review authentication logs for unexpected password logins and investigate suspected access.
- For embedded or custom builds, verify libc, PAM use, SSH settings and account fields.
Why Musl-Based Servers Need Attention
The flaw matters because an exposed SSH service is a common route for remote administration, and the reported bypass can require no valid password and no repeated attempts when all listed conditions are present. That makes identifying the affected configuration more important than treating every Linux server as vulnerable. Alpine’s advisory says a reachable SSH port is enough for the attack under those conditions.
The practical exposure may extend beyond a direct login. Alpine warns that its official tiny-cloud images from versions 3.18.11 through 3.24.3 include an alpine account with an asterisk password field and passwordless doas. Those images are safe on first boot, the advisory says, but can become exploitable once a qualifying $6$ password hash exists. An account that can escalate privileges could increase the impact of an initial bypass.
Administrators should update to a fixed package and restart sshd; installing the package alone may leave the old daemon running. If an update is not immediately possible, the source recommends setting PasswordAuthentication to no and checking authentication logs for password logins to accounts that should not accept passwords.
Products Worth Considering
Samsung 27-inch Odyssey OLED G6 QHD Gaming Monitor
LG UltraGear 34G600A-B 34-Inch Curved WQHD Gaming Monitor, 160Hz
Samsung Odyssey G9 QD-OLED 49 Dual QHD Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How the Password Check Failed
The bug arises from an interaction between OpenSSH’s password-checking path and musl’s handling of an overlong input, rather than from a flaw that affects every OpenSSH installation. When PAM is not used, sshd calls the C library’s crypt() function and compares its result with the stored password field. In the affected case, the function’s asterisk error indicator can be mistaken for a matching stored value.
OpenSSH said the root cause is outside sshd but can be avoided there. Musl maintainer Rich Felker disputed that characterization, saying he viewed the problem as “an erroneous use by the caller,” while indicating musl may change the mechanism in an upcoming release cycle. The disagreement concerns where the underlying defect belongs; it does not change the need to apply OpenSSH’s available fix.
Alpine is the best-known affected distribution because its standard openssh-server package can meet the required conditions. The researcher also identified systems built with OpenWrt, Buildroot and Yocto as potential cases, but exposure depends on their actual libraries and configuration. Ubuntu says its OpenSSH builds use glibc and PAM and are not vulnerable; Red Hat says its products are not affected. Debian’s tracker rates the issue unimportant for its packages and lists the fixed upstream version in its unstable branch.
“An attacker who can reach your SSH port can log in without knowing any password. It takes one connection, works every time, and needs no retries.”
— Alpine Linux security advisory
Which Builds Are Exposed
The vulnerability’s reach depends on several conditions, so the number of exposed servers is not established in the source material. Alpine is a confirmed example, while the presence of musl in embedded or custom Linux builds does not by itself prove they are vulnerable. Operators need to check whether sshd bypasses PAM, password authentication is enabled, the relevant account fields and hashes are present, and whether a fixed package is installed and running.
Reports of exploitation also leave important questions unanswered. GreyNoise reported a successful event on one of its sensors, and CISA listed the flaw as exploited, but the available material gives no confirmed total of compromised systems or attribution for attacks. Medcrypt said it reproduced the issue on a stock Yocto image, while the extent of exposure across medical devices and other embedded products remains unclear.
There is also a difference of view between OpenSSH and the musl maintainer about where the root cause lies. Musl’s possible future change has not been described as a substitute for applying the OpenSSH fix, and the source does not specify when that change will ship.
Patch, Restart and Review Logs
Administrators should install OpenSSH 10.6p2 or a distribution package containing the fix, then restart the SSH daemon so the corrected code is running. Alpine says fixed packages are available across its branches, including older releases. Its instructions include running apk upgrade -U -a and restarting sshd; administrators should follow their distribution’s own package and service guidance.
If a system cannot be patched promptly, disable password-based SSH logins with PasswordAuthentication no, provided that change fits the system’s access requirements. Teams should review authentication logs for unexpected password logins to accounts with no usable password, then investigate any suspected access under their incident-response procedures. The source does not provide a universal log query or establish that a particular login proves exploitation.
Operators of embedded and custom Linux devices should verify the actual libc, PAM use, sshd settings and account database rather than relying only on the distribution name. Further updates may clarify affected product builds, exploitation scale and whether musl changes its error-handling behavior in a later release.
Key Questions
What is the OpenSSH sshole vulnerability?
CVE-2026-123158 is a password-bypass flaw affecting certain OpenSSH server configurations on Linux using musl. An overlong password can produce an error value that matches an asterisk stored for an account that should not authenticate by password.
Are all Linux servers or OpenSSH installations affected?
No. The reported issue requires a specific combination, including Linux with musl, password authentication enabled, and password checks without PAM, along with particular account and password-hash conditions. Ubuntu and Red Hat said their products are not affected; Debian also reports its packages are not affected by the issue.
How can administrators reduce the risk?
Install a fixed OpenSSH package, such as version 10.6p2, and restart sshd. If patching must wait, set PasswordAuthentication to no where appropriate, and review authentication logs for unexpected password logins to accounts that should not accept them.
Does disabling root password login prevent the vulnerability?
Not necessarily. Alpine says the default PermitRootLogin prohibit-password setting protects direct root password login, but another account may still be able to gain root privileges, for example through doas. Administrators should assess all accounts and privilege-escalation paths on systems that meet the other conditions.
Has the flaw been exploited in the wild?
GreyNoise reported a successful break-in on one of its sensors about 40 hours after the fix was released, and CISA added the flaw to its exploited-vulnerabilities list on Nov. 9, 2026. The available source material does not state how many systems were affected or confirm a broader count of compromises.
Source: ThorstenMeyerAI.com
