🔍 Read the full analysis: OpenSSH SSHole: The Password Bug Attackers Are Already Using on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A flaw tracked as CVE-2026-123158 can allow passwordless SSH access on a limited set of Linux systems using musl, without PAM, and with password authentication enabled. OpenSSH released version 10.6p2 on November 5, 2026; GreyNoise reported a successful attack on a sensor about 40 hours later, and CISA added the flaw to its exploited-vulnerabilities list on November 9. Affected administrators should update, restart sshd and review authentication logs.
OpenSSH released version 10.6p2 on November 5 to fix a password-bypass flaw, CVE-2026-123158, that can let attackers access some Linux accounts without knowing a valid password. GreyNoise reported a successful break-in on one of its sensors about 40 hours after the release, while the affected configurations are limited to systems using musl without PAM and with password logins enabled.
The flaw, called “sshole” by its finder, arises when OpenSSH checks passwords without PAM on Linux systems using the musl C library. According to Alpine Linux’s advisory, musl’s crypt() function returns an asterisk as an error indicator when a supplied password exceeds 256 bytes. Some accounts that cannot normally authenticate with a password also have an asterisk in the password field. In the affected configuration, those values can match, allowing the login check to pass.
Alpine says an attacker who can reach the SSH service can trigger the issue with a password between 257 and 1,024 bytes. Its advisory also says the machine must have at least one local account with a $5$ or $6$ password hash, as sshd uses that account’s salt during the check. The bypass can then affect accounts whose stored password field is an asterisk. The precise conditions matter: this is not a general flaw in every OpenSSH installation.
OpenSSH 10.6p2 contains the fix. GreyNoise and BleepingComputer reported that exploit code became public about four hours after the release, and GreyNoise later observed a successful attack on one sensor. CISA added the vulnerability to its list of exploited vulnerabilities on November 9. Those reports establish observed exploitation, but the supplied material does not identify the target of the sensor incident or quantify attacks across the internet.
OpenSSH SSHole The password bypass
A flaw can bypass password checks on specific Linux systems. A successful attack was observed soon after the fix, so administrators should check their configuration and update.
When the bypass can work
Exposure depends on the server’s library, authentication setup and local account records.
The system uses musl and checks passwords without PAM.
The SSH service accepts password authentication.
An asterisk password field and a local $5$ or $6$ password hash are present.
Why the check failed
An overlong password can make musl return an asterisk error value, which may match an account’s stored asterisk field.
- Linux using musl
- Password checks without PAM
- PasswordAuthentication enabled
- Qualifying local account records
- glibc systems
- PAM-based password checks
- Password authentication disabled
- Non-Linux systems and Dropbear
Where to check
Distribution names alone do not confirm exposure; custom and embedded builds can differ.
What administrators should do
Verify the library, PAM use, password-authentication setting and account records.
Update to OpenSSH 10.6p2 or your distribution’s fixed package.
Restart sshd so it runs the updated code, then review authentication logs.
Risk to Musl-Based SSH Servers
The issue matters most to administrators of Alpine Linux and other systems built with musl, including some OpenWrt, Buildroot and Yocto environments. Where all required conditions are present, an exposed SSH service may permit access to accounts that were meant to be unable to log in with a password. A compromised account could also create a path to greater privileges if it has access to tools or permissions that allow escalation.
The attack does not require a sequence of password guesses, according to Alpine’s advisory. That makes a vulnerable, reachable server a practical concern even if its operators believe accounts marked with an asterisk are locked. Alpine warns that its official tiny-cloud images can become vulnerable once a qualifying password hash exists; it also notes that passwordless doas may let an attacker with access to the alpine account become root. OpenSSH’s default restriction on root password login does not by itself address that route.
Administrators should check the actual library, PAM configuration, password-authentication setting and account records, rather than assuming a system is safe based on its distribution name alone. Ubuntu says its OpenSSH packages use glibc and PAM and are not affected; Red Hat likewise says its products are not affected. Debian’s tracker rates the issue unimportant for its packages. Those statements concern their own builds and do not settle the status of every custom or embedded image.
Products Worth Considering
Amazon Kindle Paperwhite Signature Edition (12th Generation, 2024), 32 GB, Metallic Raspberry
Bose QuietComfort Wireless Noise-Cancelling Headphones, Sandstone
Samsung Galaxy Tab S7 11-inch Android Tablet 128GB Wi‑Fi with S Pen Mystic Black
As an affiliate, we earn on qualifying purchases.
How the Password Check Failed
In the affected setup, sshd checks a password without PAM by calling the system’s password-hashing function and comparing the result with the account’s stored password field. A field containing * ordinarily indicates that password login cannot succeed. The problem described by Alpine is that musl uses the same character to report an overlong input error. When the returned error value is compared with the stored field, the check can treat the error as a match.
The conditions listed by Alpine are specific: Linux with musl; password checking without PAM; PasswordAuthentication enabled; an account with an asterisk in its password field; and at least one local $5$ or $6$ password hash. Alpine’s standard openssh-server package is a known example of the relevant setup. OpenSSH says the root cause is outside sshd but exploitable through it; musl maintainer Rich Felker described the problem as an erroneous use of the library by its caller and said musl may change the mechanism in an upcoming release cycle.
The source material says systems using glibc, PAM-based password checks, or disabled password authentication are not affected by this flaw. It also excludes non-Linux systems and services such as Dropbear. The finding concerns sshd itself, not containers that do not run an SSH server inside them.
“An attacker who can reach your SSH port can log in without knowing any password. It takes one connection, works every time, and needs no retries.”
— Alpine Linux advisory
Exposure Across Embedded Linux
The full number of vulnerable systems and the scale of exploitation are not established in the supplied reports. GreyNoise reported one successful break-in on a sensor, but the source material does not give a victim identity, the attacker’s objective or evidence of broader compromise. Public exploit code appearing soon after the patch indicates that the flaw could be tested quickly; it does not show how many systems were attacked successfully.
Exposure may be harder to assess in embedded deployments. Alpine names OpenWrt, Buildroot and Yocto as possible musl environments, and Medcrypt reported reproducing the flaw on a stock Yocto image. The material does not provide a complete inventory of affected device makers, products or firmware versions. Custom builds may differ in their use of PAM, password authentication and account configuration, so inclusion of a platform in that list alone does not confirm exposure.
There is also a disagreement over whether the underlying error belongs to OpenSSH or musl. OpenSSH says the root cause is outside sshd but can be avoided there; Felker says the caller is using musl incorrectly. The practical mitigation is clear in the available advisories, but the supplied information does not confirm when or how musl will alter its behavior.
Patch, Restart and Review Logs
Administrators should install OpenSSH 10.6p2 or a fixed distribution package, then restart sshd so the running service uses the updated code. Alpine says fixes were published for branches reaching back to 3.16. It cautions that installing a package alone does not replace an already running daemon. Package names and update commands vary by operating system, so operators should follow their distribution’s advisory.
If an immediate update is not possible, Alpine’s guidance is to set PasswordAuthentication no, where that change is compatible with the service’s access requirements. Administrators should then inspect SSH authentication logs for password logins to accounts that should not have password access, particularly accounts with an asterisk in the password field. They should review any suspicious access for signs of privilege escalation and take incident-response steps appropriate to their environment.
Teams responsible for embedded or custom Linux images should verify the system’s C library, whether sshd uses PAM, whether password authentication is active, and whether the required account and password-hash conditions exist. Further developments to watch include distribution package updates, any musl change mentioned by its maintainer, and additional reporting on affected deployments or observed attacks.
Key Questions
What is the OpenSSH SSHole vulnerability?
CVE-2026-123158 is a password-bypass flaw in a narrow OpenSSH configuration. On affected Linux systems, an overlong password can trigger a musl error value that matches the stored field for some accounts that should not accept password logins.
Which systems may be vulnerable?
Systems must meet several conditions: Linux with musl, sshd checking passwords without PAM, password authentication enabled, an account with an asterisk in its password field, and a local account with a qualifying $5$ or $6$ hash. Alpine is a known example, but administrators should check their specific build.
Are Ubuntu, Debian and Red Hat affected?
Ubuntu says its OpenSSH packages use glibc and PAM and are not vulnerable; Red Hat says its products are not affected. Debian’s tracker rates the issue unimportant for its packages. These assessments do not automatically cover custom images or other builds that may use musl.
How should administrators respond?
Install OpenSSH 10.6p2 or the fixed package supplied by your distribution, then restart sshd. If patching must wait, disable password authentication if practical, and review logs for password access to accounts that should not accept passwords.
Has the flaw been exploited?
GreyNoise reported a successful break-in on one of its sensors about 40 hours after the fix was released. CISA added the vulnerability to its exploited-vulnerabilities list on November 9, 2026. The available material does not quantify wider exploitation or identify the sensor incident’s target.
Source: ThorstenMeyerAI.com
