🔍 Read the full analysis: OpenSSH SSHole Bug Explained: The Risk Of Overlong Passwords on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A flaw tracked as CVE-2026-123158 can allow passwordless SSH login under a specific set of Linux, musl and OpenSSH conditions. OpenSSH released version 10.6p2 on November 5, 2026; administrators should update and restart sshd, or disable password authentication until they can.
OpenSSH 10.6p2, released November 5, fixes CVE-2026-123158, a flaw that can let an attacker log in without a valid password on certain Linux servers. The bypass requires a specific combination of musl libc, password authentication without PAM, and affected account settings; it does not affect every OpenSSH installation.
The vulnerability, nicknamed “sshole” by its finder, involves how OpenSSH’s server, sshd, checks a password on systems using musl without PAM. Alpine Linux’s advisory says musl’s crypt() function returns an asterisk (*) as an error indicator when a password exceeds 256 bytes. On affected systems, that result can match the stored password field for an account that has no password, allowing the check to succeed. The supplied password must be in the range described in the source account of the flaw: 257 to 1,024 bytes.
The conditions are narrow but specific. Alpine lists Linux systems using musl, sshd checking passwords without PAM, password authentication being enabled, an account with a * password field, and at least one local account with a $5$ or $6$ password hash. Alpine’s standard openssh-server package is a prominent example. Ubuntu says its OpenSSH build uses glibc and PAM and is not affected; Red Hat also says its products are not affected. Debian lists the issue as “unimportant” for its packages.
Exploit code reportedly appeared about four hours after the fix, according to GreyNoise and BleepingComputer. GreyNoise reported its first successful login on a sensor about 40 hours after the release. CISA added the vulnerability to its list of exploited vulnerabilities on November 9. Administrators should install the fixed package and restart sshd; Alpine warns that updating a package alone does not replace an already running daemon. Where an update is not available, the supplied guidance is to set PasswordAuthentication no and review logs for password logins to accounts that should not accept passwords.
SSHole: The risk of overlong passwords
CVE-2026-123158 can bypass password checks on Linux servers with a specific combination of musl, SSH settings, and account conditions. OpenSSH 10.6p2 fixes the flaw.
When can the flaw apply?
Exposure depends on the system’s actual libc, SSH configuration, and account fields.
Linux with musl
The affected password-check path uses musl without PAM.
Password login enabled
The server checks passwords without PAM, and password authentication is enabled.
A matching stored field
An account has a * password field, and at least one local account has a $5$ or $6$ password hash.
How the password check fails
An error indicator can be mistaken for a valid match.
The reported input length is 257 to 1,024 bytes.
For an overlong input, musl’s crypt() returns * as an error indicator.
An account with a * password field can appear to pass the check.
Check the specific deployment
Distribution names alone do not establish whether a system is affected.
| System or environment | What the source says |
|---|---|
| Alpine standard openssh-server | Prominent affected example |
| Ubuntu | Uses glibc and PAM; reported not affected |
| Red Hat products | Reported not affected |
| OpenWrt, Buildroot, Yocto | Verify the actual libc and SSH configuration |
Mitigate and review
Make sure the running SSH service uses the fixed code.
Why the Account Match Matters
The flaw matters because it can turn an account intended to be unusable with a password into a possible route into a server. Alpine says an attacker who can reach the SSH service may be able to trigger the issue with one connection, rather than relying on repeated password guesses. If the compromised account can gain higher privileges—for example, through passwordless doas—the consequences could extend beyond that account.
Still, the risk should not be generalized to all SSH servers. The vulnerable behavior depends on multiple configuration and platform conditions, and major distributions including Ubuntu and Red Hat report that their builds are not affected. The reported exploitation and rapid availability of exploit code make checking systems worthwhile, particularly for Alpine and embedded Linux deployments, but do not establish that every system running OpenSSH is at risk.
Products Worth Considering
Apple iPad 11-inch (A16), 128GB, Wi-Fi, Silver
DJI Osmo Pocket 3 Vlogging Camera with 1-Inch CMOS Sensor and 4K/120fps Video
Kindle Paperwhite Signature Edition 32GB E-Reader, 7-Inch Display, Seaglass Green
As an affiliate, we earn on qualifying purchases.
How the Password Check Fails
Many Unix-like systems use a single asterisk in an account’s password field to indicate that no password can authenticate that account. In the affected path, sshd compares the result of a password hash operation with that stored field. Alpine’s explanation is that musl returns the same asterisk as an error marker for an overlong input, making an error look like a matching password value.
Responsibility for the underlying behavior is disputed. OpenSSH said the root cause is outside sshd, while also saying sshd can avoid the issue. Musl maintainer Rich Felker argued on the project mailing list that the problem is an erroneous use by the caller, not a musl bug, and said musl may change the mechanism in an upcoming release cycle. Those positions describe a disagreement about where the defect belongs; the practical mitigation is the OpenSSH update or disabling password authentication.
Alpine identifies its standard OpenSSH server package as an affected case and published fixed packages for branches from edge back to 3.16. The source material also names OpenWrt, Buildroot and Yocto as environments to check. A separate report from medical-device security firm Medcrypt said it reproduced the issue on a stock Yocto image. That report means embedded systems merit attention, though the full range of affected deployments has not been established.
“musl’s crypt() returns the string * as an error indicator when the key is over 256 bytes long. * is also exactly what the stored field contains for every account with no password.”
— Alpine Linux security advisory
Embedded Linux Exposure Still Unclear
The exact number of exposed servers and embedded devices is not given in the source material. Medcrypt’s report of reproduction on a stock Yocto image raises a concern for embedded deployments, but the affected configurations and product range remain unclear. Administrators need to check the particular libc, PAM use, SSH settings and account fields on each system rather than infer exposure from the operating system name alone.
There is also a difference of opinion over whether the root cause belongs to musl or to the way sshd calls it. The supplied material says musl may change its behavior in a future release cycle, but gives no release date. GreyNoise’s sensor observation and CISA’s listing indicate reported exploitation activity; they do not establish how broadly attackers have used the flaw or whether a particular organization has been compromised.
Update, Restart and Review Logs
Administrators should install OpenSSH 10.6p2 or a distribution package that includes the fix, then restart sshd so the running service uses the updated code. Alpine says it published fixed packages across branches from edge back to 3.16; package versions vary by branch. If a fix cannot be installed promptly, disable password-based SSH login with PasswordAuthentication no where operationally possible.
After mitigation, review authentication logs for unexpected password logins, especially to accounts whose password fields are set to *. Teams responsible for Alpine, OpenWrt, Buildroot or Yocto systems should verify their actual libc and PAM configuration rather than assume they are affected or safe based only on a platform label. Further clarity may come from distribution advisories, embedded vendors, and any future musl changes.
Key Questions
What is the OpenSSH SSHole vulnerability?
It is CVE-2026-123158, a password-check bypass that can affect certain Linux systems where sshd uses musl without PAM. An overlong password can produce an error value that matches the stored field for an account with no password.Which systems may be affected?
Systems must meet several conditions, including Linux with musl, password checks without PAM, password authentication enabled, an account with a* password field, and a local $5$ or $6$ password hash. Alpine’s standard openssh-server package is a known example.Are Ubuntu and Red Hat systems affected?
Ubuntu says its OpenSSH uses glibc and PAM and is not affected. Red Hat says its products are not affected. Administrators should still consult their distribution’s specific advisory and installed package status.How should administrators mitigate the flaw?
Install a fixed OpenSSH package, such as OpenSSH 10.6p2 or a distribution build containing the fix, and restart sshd. If updating is not possible yet, disable password authentication and review SSH logs for unexpected logins.Does the flaw affect every OpenSSH server?
No. The supplied advisories describe a limited set of platform and configuration conditions. Systems using glibc, PAM-based password checks, or disabled password authentication are listed as not affected by the described issue.Source: ThorstenMeyerAI.com
