🔍 Read the full analysis: OpenSSH SSHole Bug: How Attackers Take Advantage Of Overlong Passwords on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A flaw tracked as CVE-2026-123158 can let attackers log in to certain accounts on Linux systems running OpenSSH with musl, without knowing the account password. OpenSSH released version 10.6p2 on November 5, 2026; exploit code appeared about four hours later, and GreyNoise reported a successful attack on a sensor about 40 hours after release. The risk depends on several configuration conditions, and administrators should update, restart sshd, or disable password authentication if they cannot update.
OpenSSH released version 10.6p2 on November 5 to fix a flaw that can let attackers log in without a valid password on certain Linux systems using the musl C library. The issue, tracked as CVE-2026-123158 and nicknamed “sshole” by its finder, requires a particular combination of SSH and account settings; exploit code became public within hours of the fix, according to GreyNoise and BleepingComputer.
The bypass involves password checks performed by OpenSSH’s sshd without PAM on Linux systems using musl. Alpine Linux says musl’s crypt() function returns an asterisk when it receives a password longer than 256 bytes. Some accounts that are not meant to allow password logins have an asterisk in the stored password field. In the affected configuration, the error value can match that field, causing the password check to succeed.
Alpine says an attacker can try a password between 257 and 1,024 bytes against a reachable SSH service. It also lists another required condition: the system must have at least one local account with a $5$ or $6$ password hash. The bypass can affect accounts whose password field is an asterisk; it does not mean that every OpenSSH installation or every locked account is vulnerable.
Exploit code was published about four hours after the fix, according to GreyNoise and BleepingComputer. GreyNoise said its sensor recorded a successful break-in about 40 hours after the release. CISA added the vulnerability to its list of exploited vulnerabilities on November 9. These reports indicate exploitation activity, but do not establish how many systems have been compromised.
OpenSSH SSHole Bug How the password bypass works
CVE-2026-123158 can allow passwordless access to certain Linux accounts when several specific SSH, account, and system conditions align.
How the bypass works
A long password can turn a musl error value into a match for an account’s asterisk password field.
An attacker can try a password between 257 and 1,024 bytes against a reachable SSH service.
For passwords longer than 256 bytes, musl’s crypt() function returns an asterisk as an error indicator.
Without PAM, sshd may match that error value to an asterisk in the account’s stored password field.
All exposure conditions must align
Check the system and its local account settings; a distribution name alone does not determine exposure.
Linux with musl
The described bypass depends on the musl C library.
sshd without PAM
Password checks must be handled by sshd without PAM.
Password login enabled
PasswordAuthentication must be enabled.
Both account markers present
At least one account has an asterisk password field, and a local account has a $5$ or $6$ hash.
Who is outside the described exposure?
The advisories identify configurations and products reported as not affected by this flaw.
| Configuration or product | Reported status |
|---|---|
| glibc or PAM-based password checks | ✗ Not affected |
| PasswordAuthentication no | ✗ Not affected |
| Locked account marked with ! | ✗ Cannot log in through this route |
| Dropbear or containers without sshd | ✗ Outside the described exposure |
Patch and check access
Update the package and confirm the running SSH daemon has restarted with the fix.
- Install a fixed OpenSSH package; the upstream fix is in version 10.6p2.
- Restart sshd after updating, as installing a package alone does not replace the running daemon.
- If you cannot update promptly, consider setting PasswordAuthentication no if it fits access requirements.
- Review SSH logs for unexpected password logins, especially to accounts with an asterisk password field.
- For embedded builds, verify the library, PAM use, SSH setting, account fields, and local password hashes.
Why the Password Check Fails
The issue matters because the affected server may accept a login without checking a valid password for an account that is supposed to be password-locked. An exposed SSH service is commonly used for remote administration, so a successful login could give an attacker access under the affected account. The impact would depend on that account’s permissions and the system’s other controls.
Alpine warns that some of its official tiny-cloud images include an alpine account with an asterisk password field and passwordless doas. The advisory says images from versions 3.18.11 through 3.24.3 are safe on first boot but can become vulnerable once a $6$ password hash is present. It also cautions that root’s default SSH restriction does not protect a system if another accessible account can gain root privileges.
The reported timing adds urgency for affected administrators: public exploit code followed the patch quickly, and GreyNoise reported a successful attempt on a sensor. That is evidence of exploitation activity, not proof that a particular organization has been breached. Administrators should check their own package versions, configurations and authentication logs.
Products Worth Considering
Canon PIXMA PRO-200S Wireless Professional Inkjet Photo Printer
Logitech MX Master 4 Ergonomic Wireless Mouse with Haptic Feedback, Graphite
Logitech MX Master 4 for Mac Wireless Ergonomic Mouse, White Silver
As an affiliate, we earn on qualifying purchases.
Which Linux Systems Meet the Conditions
The exposure is limited to systems meeting all the conditions in Alpine’s advisory: Linux with musl libc; sshd checking passwords without PAM; password authentication enabled; at least one account whose stored password field is an asterisk; and at least one local account with a $5$ or $6$ password hash. Alpine’s standard openssh-server package is a prominent example of the relevant setup. The researcher also named OpenWrt, Buildroot and Yocto, but administrators need to verify their specific builds and settings.
OpenSSH, Alpine and musl advisories say systems using glibc, PAM-based password checks, or PasswordAuthentication no are not affected by this flaw. Alpine identifies locked accounts using ! rather than * as unable to log in through this route. Dropbear and containers that do not run sshd are also outside the described exposure.
Major distributions have reported that their builds are not vulnerable. Ubuntu says its OpenSSH is linked against glibc and uses PAM; Red Hat says its products are not affected. Debian’s security tracker labels the issue “unimportant” for its packages and lists upstream version 1:10.6p2-1 as fixed in its unstable branch. Alpine published fixed packages for its branches, including older releases.
“musl’s crypt() returns the string * as an error indicator when the key is over 256 bytes long.”
— Alpine Linux advisory
Exposure Depends on Local Setup
The number of affected or compromised systems is not established in the source material. GreyNoise’s report concerns a successful break-in on one of its sensors; it does not identify victims elsewhere or show the scale of real-world exploitation. The existence of public exploit code likewise does not confirm that a particular server was targeted.
Exposure in embedded Linux environments remains less clear. Alpine’s advisory describes the required conditions, while Medcrypt reported on the oss-security mailing list on November 9 that it had reproduced the issue on a stock Yocto image. That report does not establish that every Yocto image is vulnerable; maintainers and operators need to check whether their builds meet the configuration requirements.
OpenSSH and musl also differ on where the underlying fault belongs. OpenSSH says it can avoid the behavior in sshd, while musl maintainer Rich Felker described the caller’s use as erroneous and said musl may change the mechanism in a future release cycle. The practical status of those changes is not specified in the available material.
Patch, Restart and Review Logs
Administrators should install a fixed OpenSSH package and restart sshd; Alpine warns that installing an update alone does not replace the running daemon. The upstream fix is in OpenSSH 10.6p2. Alpine says fixed packages are available across its branches, including releases back to 3.16. Operators should consult their distribution’s advisory for the exact package version and update procedure.
If an update cannot be applied promptly, Alpine’s guidance is to set PasswordAuthentication no, provided that change fits the system’s access requirements. Administrators should also review SSH logs for password logins to accounts whose password field is an asterisk, and investigate any unexpected access. The source material does not specify a single log pattern that applies to every distribution.
Teams running OpenWrt, Buildroot, Yocto or other embedded builds should check the C library, PAM use, password-authentication setting, account fields and local password hashes rather than relying on the distribution name alone. Further updates from OpenSSH, musl and affected distribution maintainers may clarify package status and any changes to the library behavior.
Key Questions
What is the OpenSSH SSHole flaw?
It is a password-check bypass tracked as CVE-2026-123158. Under specific conditions, a very long password can cause a musl error value to match an asterisk stored for an account that is not meant to accept password logins.
Which systems are potentially affected?
Systems must meet several conditions, including running Linux with musl, using sshd without PAM for password checks, having password authentication enabled, and having the specified account and password-hash fields. Alpine’s standard openssh-server package is a known example; check the local configuration rather than assuming all Linux systems are affected.
Are Ubuntu, Debian and Red Hat affected?
Ubuntu says its OpenSSH builds use glibc and PAM and are not vulnerable. Red Hat says its products are not affected. Debian’s tracker rates the issue “unimportant” for its packages and lists a fixed upstream version in its unstable branch.
How should administrators respond?
Install a fixed OpenSSH package and restart sshd. If updating is not immediately possible, Alpine recommends setting PasswordAuthentication no. Review SSH logs for unexpected password logins to accounts with an asterisk password field.
Does public exploit code mean my server was compromised?
No. Public exploit code and GreyNoise’s report of a successful attempt on one sensor show that exploitation activity was reported, but they do not prove that any specific server or organization was compromised.
Source: ThorstenMeyerAI.com
